Integration Guide

ConduitCheckout.init({
  // REQUIRED
  sellerAddress: '0xYourWalletAddress',
  baseUrl: 'https://app.instantescrow.nz',

  // WEBHOOK CONFIG (RECOMMENDED)
  webhookUrl: 'https://yoursite.com/api/conduit-webhook',
  webhookSecret: 'your-secret-key',  // Store securely!

  onSuccess: function(verifiedData) {
    // Webhook already sent! Just show UI confirmation
    console.log('Payment verified!', verifiedData);
    window.location.href = '/thank-you?order=' + verifiedData.orderId;
  },

  onError: function(error) {
    alert('Payment failed: ' + error);
  }
});

const crypto = require('crypto');

// POST /api/conduit-webhook
app.post('/api/conduit-webhook', async (req, res) => {
  try {
    // 1. VERIFY HMAC SIGNATURE (prevents spoofing)
    const signature = req.headers['x-conduit-signature'];
    const payload = JSON.stringify(req.body);

    const expectedSig = crypto
      .createHmac('sha256', process.env.WEBHOOK_SECRET)
      .update(payload)
      .digest('hex');

    if (signature !== expectedSig) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    // 2. EXTRACT VERIFIED DATA
    const {
      contractId,
      chainAddress,
      amount,
      currencySymbol,
      state,
      verified,
      verifiedAt,
      orderId,
      email,
      metadata
    } = req.body;

    console.log('✅ Payment verified:', contractId, amount, currencySymbol);

    // 3. PROCESS PAYMENT IN YOUR SYSTEM
    await db.orders.update({
      where: { id: orderId },
      data: {
        status: 'PAID',
        paymentContractId: contractId,
        paymentChainAddress: chainAddress,
        paymentAmount: amount,
        paidAt: new Date(verifiedAt)
      }
    });

    // 4. FULFILL ORDER
    await fulfillment.ship(orderId);
    await email.sendConfirmation(email, orderId);

    // 5. RESPOND SUCCESS
    res.json({ received: true });

  } catch (error) {
    console.error('Webhook error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});
});