Crypto payments on your own server.

curl https://pay.example.com/v1/payment \
  -H "x-api-key: $TM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "price_amount": 25,
    "price_currency": "usd",
    "pay_currency": "btc",
    "order_id": "ORDER-1001",
    "order_description": "Order 1001",
    "ipn_callback_url": "https://shop.example.com/turmite/ipn"
  }'

{
  "payment_id": "5524759814",
  "payment_status": "waiting",
  "pay_address": "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
  "pay_amount": 0.00041235,
  "pay_currency": "btc"
}

import crypto from 'node:crypto';
import express from 'express';

function verify(raw, headers, secret) {
  const ts = String(headers['x-turmite-timestamp'] ?? '');
  const sig = String(headers['x-turmite-signature'] ?? '');
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const mac = crypto.createHmac('sha256', secret)
    .update(`${ts}.`).update(raw).digest('hex');
  const want = Buffer.from(`v1=${mac}`);
  const got = Buffer.from(sig);
  return got.length === want.length && crypto.timingSafeEqual(got, want);
}

const app = express();
app.post('/turmite/ipn', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verify(req.body, req.headers, process.env.TM_IPN_SECRET)) {
    return res.sendStatus(401);
  }
  const payment = JSON.parse(req.body);
  if (payment.payment_status === 'finished') markPaid(payment.order_id);
  res.sendStatus(200);
});