Authorization: Bearer your_api_key_here

{
  "detail": "Too many requests, please slow down."
}

{
  "event": "order.paid",
  "order_id": "GP-BSC-48291734",
  "link_id": "GP-A1B2C3",
  "status": "paid",
  "amount": "30.148293",
  "token": "usdt",
  "network": "bsctestnet",
  "usd_value": 29.99,
  "customer_email": "buyer@example.com",
  "tx_hash": "0x9f3c…e1a7",
  "paid_at": "2026-09-03T14:36:12+00:00"
}

// Node.js (Express) — verify a GhostPay webhook
import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.GHOSTPAY_WEBHOOK_SECRET;

// Use the RAW body for signing — express.raw() keeps it untouched.
app.post("/webhooks/ghostpay", express.raw({ type: "*/*" }), (req, res) => {
  const ts = req.get("X-GhostPay-Timestamp") || "";
  const sigHeader = req.get("X-GhostPay-Signature") || "";
  const parts = Object.fromEntries(
    sigHeader.split(",").map((kv) => kv.split("=").map((s) => s.trim()))
  );

  // 1. Timestamp tolerance (5 minutes)
  const now = Math.floor(Date.now() / 1000);
  if (!ts || parts.t !== ts || Math.abs(now - Number(ts)) > 300) {
    return res.status(400).send("stale or missing timestamp");
  }

  // 2. Recompute HMAC over "<ts>.<raw body>"
  const rawBody = req.body.toString("utf8");
  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${ts}.${rawBody}`)
    .digest("hex");

  // 3. Constant-time compare
  const given = Buffer.from(parts.v1 || "", "hex");
  const want = Buffer.from(expected, "hex");
  if (given.length !== want.length || !crypto.timingSafeEqual(given, want)) {
    return res.status(401).send("invalid signature");
  }

  const event = JSON.parse(rawBody);
  if (event.event === "order.paid") {
    // TODO: deliver the product for event.order_id (idempotently)
  }
  res.sendStatus(200);
});

app.listen(3000);

{
  "detail": {
    "code": "not_found",
    "message": "Payment link not found."
  }
}

const API_KEY = process.env.GHOSTPAY_API_KEY;
const BASE = "https://ghostpay-production.up.railway.app/v1";

// 1. Create a payment link
const linkRes = await fetch(`${BASE}/payment-links`, {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    title: "Pro Plan",
    amount_usd: "19.99",
    tokens: ["usdt", "usdc"],
    networks: ["bsc"],
  }),
});

const { data: link } = await linkRes.json();
// link.checkout_url → e.g. "https://ghostpay.cloud/checkout/GP-A1B2C3"

// 2. Later — check for paid orders (or use webhooks instead)
const ordersRes = await fetch(`${BASE}/orders?status=paid`, {
  headers: { "Authorization": `Bearer ${API_KEY}` },
});
const { data: orders } = await ordersRes.json();

for (const order of orders) {
  // order.order_id, order.token, order.network, order.link_id
}