Payment gateway API

curl -s -X POST https://plaxswap.com/api/v1/payments \
  -H "Authorization: Bearer pxs_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1042" \
  -d '{
    "amount": "100",
    "currency": "USD",
    "receive": "usdt-tron",
    "orderId": "1042",
    "description": "2 x T-shirt",
    "returnUrl": "https://shop.example/orders/1042/thanks",
    "cancelUrl": "https://shop.example/cart"
  }'

{
  "id": "pay_7m2k9q4x8c1v5b3n",
  "object": "payment",
  "livemode": false,
  "status": "pending",
  "amount": "100",
  "currency": "USD",
  "receive": { "id": "usdt-tron", "assetId": "USDT", "networkId": "tron", "label": "USDT · Tron (TRC-20)", "decimals": 6, "memoRequired": false },
  "receiveAddress": null,
  "receiveAmount": "100",
  "expectedAmount": "100",
  "receivedAmount": "0",
  "fee": { "bps": 150, "paidBy": "customer", "amount": "1.5" },
  "orderId": "1042",
  "checkoutUrl": "https://plaxswap.com/checkout/pay_7m2k9q4x8c1v5b3n",
  "expiresAt": "2026-10-20T11:00:00.000Z",
  "transactions": [],
  ...
}

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.PLAXSWAP_WEBHOOK_SECRET; // whsec_...

// The raw body is needed for the signature check.
app.post("/plaxswap-webhook", express.raw({ type: "application/json" }), async (req, res) => {
  const header = req.get("x-px-signature") || "";
  const [, t, v1] = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header) || [];
  const expected = crypto.createHmac("sha256", SECRET).update(`${t}.${req.body}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  if (!v1 || !fresh || !crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  const payment = event.data;
  // Test events must never fulfil real orders. Bind to the stored gateway payment ID, not a customer-provided order number.
  if (!event.livemode || !payment.livemode) return res.sendStatus(200);
  if (event.event === "payment.paid") {
    const expected = await findShopOrderByPaymentId(payment.id);
    if (!expected || expected.gatewayPaymentId !== payment.id || expected.orderId !== payment.orderId) return res.sendStatus(400);
    // This function must deduplicate event.id and atomically fulfil only once; compare the expected coin and amount too.
    await fulfilOrderOnce(expected, event.id, payment);
  }
  res.sendStatus(200); // any 2xx within 8 seconds
});

curl -s -X POST https://plaxswap.com/api/v1/payments/pay_7m2k9q4x8c1v5b3n/simulate \
  -H "Authorization: Bearer pxs_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "outcome": "paid" }'

{
  "id": "evt_3k9q2m7x8c1v5b4n",
  "event": "payment.paid",
  "livemode": true,
  "createdAt": "2026-10-20T10:22:05.000Z",
  "data": { "id": "pay_7m2k9q4x8c1v5b3n", "object": "payment", "status": "paid", "orderId": "1042", "receivedAmount": "99.84", ... }
}

<?php
$key = getenv('PLAXSWAP_KEY');            // pxs_live_... or pxs_test_...
$ch = curl_init('https://plaxswap.com/api/v1/payments');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $key, 'Content-Type: application/json', 'Idempotency-Key: order-' . $orderId],
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => '100', 'currency' => 'USD', 'receive' => 'usdt-tron',
    'orderId' => (string) $orderId, 'returnUrl' => 'https://shop.example/thanks',
  ]),
]);
$payment = json_decode(curl_exec($ch), true);
header('Location: ' . $payment['checkoutUrl']);

// The webhook endpoint:
$raw = file_get_contents('php://input');
if (!preg_match('/^t=(\d+),v1=([0-9a-f]{64})$/', $_SERVER['HTTP_X_PX_SIGNATURE'] ?? '', $m)) { http_response_code(400); exit; }
$expected = hash_hmac('sha256', $m[1] . '.' . $raw, getenv('PLAXSWAP_WEBHOOK_SECRET'));
if (!hash_equals($expected, $m[2]) || abs(time() - (int) $m[1]) > 300) { http_response_code(400); exit; }
$event = json_decode($raw, true);
if ($event['event'] === 'payment.paid') { mark_order_paid($event['data']['orderId']); }
http_response_code(200);

import hashlib, hmac, os, time, requests
from flask import Flask, abort, request

API = "https://plaxswap.com/api/v1"
KEY = os.environ["PLAXSWAP_KEY"]

def create_payment(order_id, usd):
    r = requests.post(f"{API}/payments", timeout=15,
        headers={"Authorization": f"Bearer {KEY}", "Idempotency-Key": f"order-{order_id}"},
        json={"amount": str(usd), "currency": "USD", "receive": "usdt-tron", "orderId": str(order_id)})
    r.raise_for_status()
    return r.json()["checkoutUrl"]

app = Flask(__name__)

@app.post("/plaxswap-webhook")
def webhook():
    raw = request.get_data()
    parts = dict(p.split("=", 1) for p in request.headers.get("x-px-signature", "").split(",") if "=" in p)
    expected = hmac.new(os.environ["PLAXSWAP_WEBHOOK_SECRET"].encode(), parts.get("t", "").encode() + b"." + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, parts.get("v1", "")) or abs(time.time() - int(parts.get("t", 0))) > 300:
        abort(400)
    event = request.get_json()
    if event["event"] == "payment.paid":
        mark_order_paid(event["data"]["orderId"])
    return "", 200

const res = await fetch("https://plaxswap.com/api/v1/payments", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PLAXSWAP_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": `order-${order.id}`,
  },
  body: JSON.stringify({ amount: order.total, currency: "USD", receive: "usdc-base", orderId: order.id, returnUrl: `https://shop.example/orders/${order.id}` }),
});
if (!res.ok) throw new Error((await res.json()).error.message);
const payment = await res.json();
redirect(payment.checkoutUrl);