TxRoutePay API

const res = await fetch("https://txroutepay.com/v1/invoices", {
  method: "POST",
  headers: {
    authorization: `Bearer ${process.env.TXROUTE_KEY}`,
    "content-type": "application/json",
    "idempotency-key": "order-1043",
  },
  body: JSON.stringify({ external_order_id: "1043", amount: "49.99", currency: "USDT", network: "tron-mainnet" }),
});
const invoice = await res.json();
// redirect the customer to invoice.checkout_url

<a class="txr-pay" href="/pay-usdt?order=1043&network=trc20">Pay with USDT <small>TRC20</small></a>
<a class="txr-pay" href="/pay-usdt?order=1043&network=bep20">Pay with USDT <small>BEP20</small></a>

<style>
  .txr-pay { display: inline-flex; align-items: center; gap: 8px; padding: 12px 20px; border-radius: 10px;
             background: #2f5bea; color: #fff; font: 600 15px system-ui, sans-serif; text-decoration: none; }
  .txr-pay:hover { background: #2449c9; }
  .txr-pay small { font-weight: 500; opacity: .8; }
</style>

<?php
// pay-usdt.php — your server creates the invoice, then sends the customer to the checkout.
$apiKey  = getenv('TXROUTEPAY_KEY');            // pk_live_… (never put it in the page)
$orderId = $_GET['order'];                       // your own order id
$order   = load_order($orderId);                 // your code: read the order from your database
$network = ($_GET['network'] ?? 'trc20') === 'bep20' ? 'bsc-mainnet' : 'tron-mainnet';

$ch = curl_init('https://txroutepay.com/v1/invoices');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer $apiKey",
    'Content-Type: application/json',
    "Idempotency-Key: order-$orderId-$network",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    'external_order_id' => "$orderId-$network",
    'amount'   => number_format($order['total'], 2, '.', ''),   // "49.99"
    'currency' => 'USDT',
    'network'  => $network,
    'metadata' => ['description' => "Order #$orderId", 'customer_email' => $order['email']],
  ]),
]);
$invoice = json_decode(curl_exec($ch), true);
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) >= 300) { http_response_code(502); exit('Payment could not be started'); }

save_invoice_id($orderId, $invoice['id']);       // your code: remember which invoice belongs to the order
header('Location: ' . $invoice['checkout_url']);

<?php
// txroutepay-webhook.php — set this URL in Developers → Webhooks.
$secret = getenv('TXROUTEPAY_WEBHOOK_SECRET');   // whsec_…
$apiKey = getenv('TXROUTEPAY_KEY');
$raw    = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_GATEWAY_SIGNATURE'] ?? '';

// 1. Check the signature: t=<unix>,v1=<hex>[,v1=<hex>]
$t = null; $sigs = [];
foreach (explode(',', $header) as $part) {
  [$k, $v] = array_pad(explode('=', $part, 2), 2, '');
  if ($k === 't') $t = $v;
  if ($k === 'v1') $sigs[] = $v;
}
$expected = hash_hmac('sha256', "$t.$raw", $secret);
$ok = $t && abs(time() - (int)$t) <= 300;
$ok = $ok && count(array_filter($sigs, fn($s) => hash_equals($expected, $s))) > 0;
if (!$ok) { http_response_code(400); exit('bad signature'); }

// 2. Read the event, then fetch the invoice from the API (the source of truth)
$event = json_decode($raw, true);
if (in_array($event['type'], ['invoice.paid', 'invoice.overpaid', 'invoice.paid_late'], true)) {
  $ch = curl_init('https://txroutepay.com/v1/invoices/' . urlencode($event['data']['invoice_id']));
  curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ["Authorization: Bearer $apiKey"]]);
  $inv = json_decode(curl_exec($ch), true);

  if (in_array($inv['status'], ['paid', 'overpaid', 'paid_late'], true)) {
    mark_order_paid($inv['external_order_id'], $inv['amount_confirmed']);  // your code; make it safe to run twice
  }
}
http_response_code(200);                         // answer within 10 seconds

// npm install express
import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const API = "https://txroutepay.com/v1";
const KEY = process.env.TXROUTEPAY_KEY;                 // pk_live_…
const SECRET = process.env.TXROUTEPAY_WEBHOOK_SECRET;   // whsec_…
const PAID = ["paid", "overpaid", "paid_late"];
const app = express();

// 1. "Pay with USDT" → create the invoice on your server, redirect to the checkout
app.get("/pay-usdt", async (req, res) => {
  const order = await loadOrder(req.query.order);                     // your code
  const network = req.query.network === "bep20" ? "bsc-mainnet" : "tron-mainnet";
  const r = await fetch(`${API}/invoices`, {
    method: "POST",
    headers: { authorization: `Bearer ${KEY}`, "content-type": "application/json",
               "idempotency-key": `order-${order.id}-${network}` },
    body: JSON.stringify({ external_order_id: `${order.id}-${network}`, amount: order.total.toFixed(2),
                           currency: "USDT", network, metadata: { description: `Order #${order.id}` } }),
  });
  if (!r.ok) return res.status(502).send("Payment could not be started");
  const invoice = await r.json();
  await saveInvoiceId(order.id, invoice.id);                          // your code
  res.redirect(invoice.checkout_url);
});

// 2. Webhook: keep the raw body for the signature check
export function verify(raw, header, secret) {
  const parts = String(header).split(",").map((p) => p.split("="));
  const t = parts.find(([k]) => k === "t")?.[1];
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${raw}`).digest("hex");
  return parts.some(([k, v]) => k === "v1" && v?.length === expected.length
    && timingSafeEqual(Buffer.from(v), Buffer.from(expected)));
}

app.post("/webhooks/txroutepay", express.raw({ type: "application/json" }), async (req, res) => {
  const raw = req.body.toString("utf8");
  if (!verify(raw, req.get("x-gateway-signature"), SECRET)) return res.status(400).send("bad signature");
  const event = JSON.parse(raw);
  if (PAID.includes(event.type.replace("invoice.", ""))) {
    const inv = await (await fetch(`${API}/invoices/${event.data.invoice_id}`,
      { headers: { authorization: `Bearer ${KEY}` } })).json();     // the API is the source of truth
    if (PAID.includes(inv.status)) await markOrderPaid(inv.external_order_id, inv.amount_confirmed); // your code
  }
  res.sendStatus(200);
});

app.listen(3000);

# pip install flask requests
import hashlib, hmac, os, time
import requests
from flask import Flask, abort, redirect, request

API = "https://txroutepay.com/v1"
KEY = os.environ["TXROUTEPAY_KEY"]                    # pk_live_…
SECRET = os.environ["TXROUTEPAY_WEBHOOK_SECRET"]      # whsec_…
PAID = {"paid", "overpaid", "paid_late"}
app = Flask(__name__)

@app.get("/pay-usdt")
def pay_usdt():
    order = load_order(request.args["order"])                       # your code
    network = "bsc-mainnet" if request.args.get("network") == "bep20" else "tron-mainnet"
    r = requests.post(f"{API}/invoices", timeout=20,
        headers={"Authorization": f"Bearer {KEY}", "Idempotency-Key": f"order-{order['id']}-{network}"},
        json={"external_order_id": f"{order['id']}-{network}", "amount": f"{order['total']:.2f}",
              "currency": "USDT", "network": network, "metadata": {"description": f"Order #{order['id']}"}})
    if r.status_code >= 300:
        abort(502)
    invoice = r.json()
    save_invoice_id(order["id"], invoice["id"])                     # your code
    return redirect(invoice["checkout_url"])

def verify(raw: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = [p.split("=", 1) for p in (header or "").split(",") if "=" in p]
    t = next((v for k, v in parts if k == "t"), None)
    if not t or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return any(k == "v1" and hmac.compare_digest(v, expected) for k, v in parts)

@app.post("/webhooks/txroutepay")
def webhook():
    raw = request.get_data()
    if not verify(raw, request.headers.get("X-Gateway-Signature", ""), SECRET):
        abort(400)
    event = request.get_json()
    if event["type"].removeprefix("invoice.") in PAID:
        inv = requests.get(f"{API}/invoices/{event['data']['invoice_id']}", timeout=20,
                           headers={"Authorization": f"Bearer {KEY}"}).json()   # source of truth
        if inv["status"] in PAID:
            mark_order_paid(inv["external_order_id"], inv["amount_confirmed"])  # your code
    return "", 200

curl https://txroutepay.com/v1/invoices \
  -H "Authorization: Bearer pk_test_…" \
  -H "Idempotency-Key: order-1043" \
  -H "Content-Type: application/json" \
  -d '{
    "external_order_id": "1043",
    "amount": "49.99",
    "currency": "USDT",
    "network": "tron-nile",
    "expires_in_minutes": 60,
    "metadata": { "description": "Jamdani saree", "customer_email": "rina@example.com" }
  }'

{
  "id": "6f1c2a4e-…",
  "external_order_id": "1043",
  "status": "awaiting_payment",
  "network": "tron-nile",
  "currency": "USDT",
  "address": "TQm1…7xLp",
  "amount": "49.99",
  "amount_detected": "0",
  "amount_confirmed": "0",
  "fee_bps": 100,
  "checkout_url": "https://pay.txroutepay.com/pay/6f1c2a4e-…",
  "expires_at": "2026-10-17T11:00:00.000Z",
  "paid_at": null,
  "created_at": "2026-10-17T10:00:00.000Z",
  "metadata": { "description": "Jamdani saree" }
}

curl https://txroutepay.com/v1/invoices/6f1c2a4e-…/refunds \
  -H "Authorization: Bearer pk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "amount": "10.00", "reason": "Item out of stock", "tx_hash": "0x…", "email_customer": "rina@example.com" }'

{
  "id": "evt_…",
  "type": "invoice.paid",
  "created_at": "2026-10-17T10:03:12.000Z",
  "data": {
    "invoice_id": "6f1c2a4e-…",
    "status": "paid",
    "amount_expected_base_units": "49990000",
    "amount_confirmed_base_units": "49990000",
    "tx_hash": "a91e…"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// Header "X-Gateway-Signature: t=<unix>,v1=<hex>[,v1=<hex>]"
export function verify(rawBody, header, secret) {
  const parts = header.split(",").map((p) => p.split("="));
  const t = parts.find(([k]) => k === "t")?.[1];
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // 5 min replay window
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return parts.some(([k, v]) => k === "v1" && v.length === expected.length
    && timingSafeEqual(Buffer.from(v), Buffer.from(expected)));
}