CryptoPAY Merchant API

curl -X POST https://cryptopay.webprompt.icu/api/v1/orders/create \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "ORDER-001",
    "amount": 1000.00,
    "currency": "RUB",
    "notify_url": "https://yoursite.com/webhook",
    "redirect_url": "https://yoursite.com/success",
    "sign": "COMPUTED_HMAC_SHA256_HEX"
  }'

import hmac, hashlib, json, requests

API_KEY = "your_api_key"
API_SECRET = "your_api_secret"
BASE_URL = "https://cryptopay.webprompt.icu"

def sign(params: dict, secret: str) -> str:
    sorted_str = "&".join(f"{k}={v}" for k, v in sorted(params.items()))
    return hmac.new(secret.encode(), sorted_str.encode(), hashlib.sha256).hexdigest()

# Build request
data = {
    "order_id": "ORDER-001",
    "amount": 1000.00,
    "currency": "RUB",
    "notify_url": "https://yoursite.com/webhook",
    "redirect_url": "https://yoursite.com/success",
}
data["sign"] = sign(data, API_SECRET)

response = requests.post(
    f"{BASE_URL}/api/v1/orders/create",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json=data,
)

result = response.json()
print(result["data"]["payment_url"])
# → Redirect user to this URL

import crypto from 'crypto';

const API_KEY = 'your_api_key';
const API_SECRET = 'your_api_secret';
const BASE_URL = 'https://cryptopay.webprompt.icu';

function sign(params, secret) {
  const sorted = Object.keys(params).sort()
    .map(k => `${k}=${params[k]}`).join('&');
  return crypto.createHmac('sha256', secret)
    .update(sorted).digest('hex');
}

const data = {
  order_id: 'ORDER-001',
  amount: 1000.00,
  currency: 'RUB',
  notify_url: 'https://yoursite.com/webhook',
  redirect_url: 'https://yoursite.com/success',
};
data.sign = sign(data, API_SECRET);

const res = await fetch(`${BASE_URL}/api/v1/orders/create`, {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(data),
});

const result = await res.json();
console.log(result.data.payment_url);
// → Redirect user to this URL

<?php
$apiKey = 'your_api_key';
$apiSecret = 'your_api_secret';
$baseUrl = 'https://cryptopay.webprompt.icu';

function sign(array $params, string $secret): string {
    ksort($params);
    $str = http_build_query($params, '', '&', PHP_QUERY_RFC3986);
    return hash_hmac('sha256', $str, $secret);
}

$data = [
    'order_id'     => 'ORDER-001',
    'amount'       => 1000.00,
    'currency'     => 'RUB',
    'notify_url'   => 'https://yoursite.com/webhook',
    'redirect_url' => 'https://yoursite.com/success',
];
$data['sign'] = sign($data, $apiSecret);

$ch = curl_init("$baseUrl/api/v1/orders/create");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer $apiKey",
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode($data),
]);

$result = json_decode(curl_exec($ch), true);
curl_close($ch);

$paymentUrl = $result['data']['payment_url'];
header("Location: $paymentUrl");
// → Redirect user to payment page

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"net/http"
	"sort"
	"strings"
	"bytes"
)

const (
	apiKey    = "your_api_key"
	apiSecret = "your_api_secret"
	baseURL   = "https://cryptopay.webprompt.icu"
)

func sign(params map[string]interface{}, secret string) string {
	keys := make([]string, 0, len(params))
	for k := range params {
		keys = append(keys, k)
	}
	sort.Strings(keys)
	parts := make([]string, 0, len(keys))
	for _, k := range keys {
		parts = append(parts, fmt.Sprintf("%s=%v", k, params[k]))
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strings.Join(parts, "&")))
	return hex.EncodeToString(mac.Sum(nil))
}

func main() {
	data := map[string]interface{}{
		"order_id":     "ORDER-001",
		"amount":       1000.00,
		"currency":     "RUB",
		"notify_url":   "https://yoursite.com/webhook",
		"redirect_url": "https://yoursite.com/success",
	}
	data["sign"] = sign(data, apiSecret)

	body, _ := json.Marshal(data)
	req, _ := http.NewRequest("POST", baseURL+"/api/v1/orders/create", bytes.NewReader(body))
	req.Header.Set("Authorization", "Bearer "+apiKey)
	req.Header.Set("Content-Type", "application/json")

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()

	var result map[string]interface{}
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result["data"].(map[string]interface{})["payment_url"])
}

curl -X POST https://cryptopay.webprompt.icu/api/v1/orders/cancel \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"trade_id": "20260322a1b2c3d4e5f67890", "sign": "HMAC_HEX"}'

data = {"trade_id": "20260322a1b2c3d4e5f67890"}
data["sign"] = sign(data, API_SECRET)

response = requests.post(
    f"{BASE_URL}/api/v1/orders/cancel",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json=data,
)
print(response.json())

const data = { trade_id: '20260322a1b2c3d4e5f67890' };
data.sign = sign(data, API_SECRET);

const res = await fetch(`${BASE_URL}/api/v1/orders/cancel`, {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${API_KEY}`, 'Content-Type': 'application/json' },
  body: JSON.stringify(data),
});
console.log(await res.json());

curl https://cryptopay.webprompt.icu/api/v1/orders/query/20260322a1b2c3d4e5f67890 \
  -H "Authorization: Bearer YOUR_API_KEY"

trade_id = "20260322a1b2c3d4e5f67890"
response = requests.get(
    f"{BASE_URL}/api/v1/orders/query/{trade_id}",
    headers={"Authorization": f"Bearer {API_KEY}"},
)
order = response.json()["data"]
print(f"Status: {order['status']}, Amount: {order['actual_amount']} USDT")

const tradeId = '20260322a1b2c3d4e5f67890';
const res = await fetch(`${BASE_URL}/api/v1/orders/query/${tradeId}`, {
  headers: { 'Authorization': `Bearer ${API_KEY}` },
});
const { data: order } = await res.json();
console.log(`Status: ${order.status}, Amount: ${order.actual_amount} USDT`);

# Flask example
from flask import Flask, request, jsonify
import hmac, hashlib

app = Flask(__name__)
API_SECRET = "your_api_secret"

def verify_sign(payload: dict, secret: str) -> bool:
    received_sign = payload.pop("sign", "")
    sorted_str = "&".join(f"{k}={v}" for k, v in sorted(payload.items()))
    expected = hmac.new(secret.encode(), sorted_str.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(received_sign, expected)

@app.route("/webhook", methods=["POST"])
def webhook():
    data = request.json

    if not verify_sign(dict(data), API_SECRET):
        return "Invalid signature", 403

    trade_id = data["trade_id"]
    order_id = data["order_id"]
    amount_usdt = data["actual_amount"]

    # ✅ Mark order as paid in your database
    print(f"Payment confirmed: {order_id} — {amount_usdt} USDT")

    return "ok", 200  # Must return 200!

// Express example
import express from 'express';
import crypto from 'crypto';

const app = express();
app.use(express.json());

const API_SECRET = 'your_api_secret';

function verifySign(payload, secret) {
  const { sign: receivedSign, ...fields } = payload;
  const sorted = Object.keys(fields).sort()
    .map(k => `${k}=${fields[k]}`).join('&');
  const expected = crypto.createHmac('sha256', secret)
    .update(sorted).digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(receivedSign), Buffer.from(expected)
  );
}

app.post('/webhook', (req, res) => {
  if (!verifySign(req.body, API_SECRET)) {
    return res.status(403).send('Invalid signature');
  }

  const { trade_id, order_id, actual_amount } = req.body;
  // ✅ Mark order as paid in your database
  console.log(`Payment confirmed: ${order_id} — ${actual_amount} USDT`);

  res.status(200).send('ok'); // Must return 200!
});

<?php
$apiSecret = 'your_api_secret';
$payload = json_decode(file_get_contents('php://input'), true);

// Verify signature
$receivedSign = $payload['sign'];
unset($payload['sign']);
ksort($payload);
$str = http_build_query($payload, '', '&', PHP_QUERY_RFC3986);
$expected = hash_hmac('sha256', $str, $apiSecret);

if (!hash_equals($expected, $receivedSign)) {
    http_response_code(403);
    die('Invalid signature');
}

$orderId = $payload['order_id'];
$amountUsdt = $payload['actual_amount'];

// ✅ Mark order as paid in your database
error_log("Payment confirmed: $orderId — $amountUsdt USDT");

http_response_code(200);
echo 'ok'; // Must return 200!

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	var payload map[string]interface{}
	json.NewDecoder(r.Body).Decode(&payload)

	receivedSign := payload["sign"].(string)
	delete(payload, "sign")

	// Sort keys and build string
	keys := make([]string, 0)
	for k := range payload { keys = append(keys, k) }
	sort.Strings(keys)
	parts := make([]string, 0)
	for _, k := range keys {
		parts = append(parts, fmt.Sprintf("%s=%v", k, payload[k]))
	}

	mac := hmac.New(sha256.New, []byte(apiSecret))
	mac.Write([]byte(strings.Join(parts, "&")))
	expected := hex.EncodeToString(mac.Sum(nil))

	if !hmac.Equal([]byte(receivedSign), []byte(expected)) {
		http.Error(w, "Invalid signature", 403)
		return
	}

	// ✅ Mark order as paid
	log.Printf("Payment confirmed: %s — %v USDT",
		payload["order_id"], payload["actual_amount"])

	w.WriteHeader(200)
	w.Write([]byte("ok")) // Must return 200!
}