Developers

Get paid via API: invoices & webhooks

Create TON & USDT invoices, share hosted checkout, and get notified when customers pay. Non-custodial: funds go to your Tonkeeper wallet.

Open web gateway → Merchant API Open Telegram bot

Store

WooCommerce

Install the AuraPay gateway plugin

Store

Shopify

Invoice script + webhook worker

Create a named API key

API base URL: https://api.aurapayglobal.com. Auth with Authorization: Bearer apk_live_… or apk_test_… (no separate merchant login handshake).

On the web gateway open Merchant → Merchant API(or Services → API in Telegram). Give the key a name, choose Test (`apk_test_…`) or Live (`apk_live_…`), then optionally set webhook URL + secret. The create response returns the secret once, plus endpoint hints.

Test

Sandbox key

Use while integrating. Invoices are stamped with metadata.environment=test.

Live

Production key

Real payable invoices to the payout address saved for that chain. Hosted invoices are 0% platform fee.

Create an invoice

curl -X POST https://api.aurapayglobal.com/api/v1/invoices \
  -H "Authorization: Bearer apk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 5,
    "currency": "USDT",
    "chain": "TRON",
    "externalId": "order_1001",
    "note": "Premium plan",
    "expiresInSeconds": 3600
  }'

Optional chain is TRON, EVM, or SOLANA. Omit it for TON. A new invoice returns 201. The same externalId returns 200 with reused: true. Response includes checkoutUrl and payUrl. TRON responses also include payableAmount.

Hosted checkout

Customers open https://pay.aurapayglobal.com/pay/PR-XXXXXX. TRON shows a QR and the merchant address; the buyer sends the exact payable amount. EVM uses RainbowKit. Solana uses Phantom or Solflare. TON uses TonConnect and a PR-XXXXXX memo. One confirmed hash is stored as networkTxHash and cannot settle a second invoice.

Webhooks

AuraPay POSTs signed JSON (retried up to 3 times). Each body includes a unique event_id (evt_ plus 32 hex characters). Manual retries reuse that id so you can dedupe.

Event

payment.confirmed: paid on-chain

Event

payment.expired: timed out unpaid

Verify X-AuraPay-Signature as sha256=HMAC_SHA256(secret, rawBody). Also require X-AuraPay-Timestamp (Unix milliseconds) and reject deliveries that drift by more than about 5 minutes.

API surface

GET/api/v1/health

Public health check (no auth)

POST/api/v1/invoices

Create an invoice. Optional chain: TRON, EVM, or SOLANA. Omit chain for TON.

GET/api/v1/invoices

List invoices (?status=&limit=)

GET/api/v1/invoices/:ref

Get invoice status

DELETE/api/v1/invoices/:ref

Cancel a pending invoice

GET/api/v1/orders/:ref

Get shop order status

5 min

5-Minute Quickstart: Embeddable Web Checkout

Create an invoice, drop in sdk.js, and open hosted checkout in a modal. Existing API, webhook, and hosted URL docs above stay unchanged.

01
Create live API keys
Sign in and copy a production (apk_live_…) or test (apk_test_…) key at www.aurapayglobal.com/dashboard?tab=developers. Auth works with X-Api-Key or the Bearer header documented above.

Create an invoice via API

POST

curl

curl -X POST https://api.aurapayglobal.com/api/v1/invoices \
  -H "X-Api-Key: $AURAPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"amount": 10.00, "currency": "USDT", "description": "Order #1042"}'

Response includes id (same value as referenceCode) and checkoutUrl:

response

{
  "id": "PR-XXXXXX",
  "checkoutUrl": "https://pay.aurapayglobal.com/pay/PR-XXXXXX"
}

Drop in the embed SDK

HTML

sdk.js

<script src="https://app.aurapayglobal.com/sdk.js"></script>
<button onclick="AuraPay.checkout({ 
  invoiceId: 'PR-XXXXXX', 
  onSuccess: (data) => console.log('Paid:', data.txHash),
  onClose: () => console.log('Modal closed')
})">
  Pay with AuraPay
</button>

Verify the payment

webhook

After on-chain confirmation AuraPay POSTs a signed payment.confirmed webhook. Verify X-AuraPay-Signature as sha256=HMAC_SHA256(secret, rawBody) and check X-AuraPay-Timestamp before fulfilling the order. Store event_id so retries are not applied twice. Do not trust the SDK onSuccess callback alone. If a payment stays unmatched, ask support for a TICK-XXXXXX escalation and quote that code with the PR- reference.

event

{
  "event_id": "evt_9b1deb4d3b7d4a1b8c3d4e5f67890123",
  "event": "payment.confirmed",
  "referenceCode": "PR-XXXXXX",
  "amount": 10,
  "currency": "USDT",
  "txHash": "…",
  "paidAt": "2026-09-16T12:00:00.000Z",
  "timestamp": "2026-09-16T12:00:00.000Z"
}

HMAC check (Node)

import { createHmac, timingSafeEqual } from 'crypto';

const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
const header = String(req.headers['x-aurapay-signature'] || '');
const a = Buffer.from(expected);
const b = Buffer.from(header);
const ok = a.length === b.length && timingSafeEqual(a, b);