Repository navigation
fix(payments): use the real CoinPay API, every coin plus PayPal - #122
Merged
Merged
Conversation
The checkout called POST /v1/invoices on api.coinpayportal.com, a host and
an endpoint that do not exist, so no order could ever be paid.
- createCheckout uses CoinPay hosted checkout sessions when the endpoint
exists (feature-detected, COINPAY_CHECKOUT_SESSIONS=auto|on|off), else
POST /api/payments/create for a coin the business holds a wallet for
(GET /api/supported-coins) or POST /api/paypal/payments/create.
- Every rail carries metadata {property, account_id, email, order_id}; the
CoinPay id is stored on the order as <rail>:<id> because crypto
confirmations and PayPal events carry only the payment id.
- Webhook verifies X-CoinPay-Signature t=..,v1=.., reads the nested payload
(data.payment_id, not the event id), maps the order by stored ref then
metadata.order_id, and acks unknown orders with 200.
- Checkout page is live: coin picker plus PayPal; /checkout/success and
/checkout/cancel pages exist.
- Cron reconciliation reads GET /api/payments/:id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan1 finding(s) MEDIUM: 1
Snippets are redacted; ThreatCrush never prints matched credential material. |
This was referenced Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The checkout called
POST /v1/invoicesonapi.coinpayportal.com, a host and endpoint that do not exist, so no order could be paid.POST /api/checkout/sessions) when available, feature-detected (404 = not yet, rechecked every 10 min) or forced viaCOINPAY_CHECKOUT_SESSIONS. Fallback: a picker over every coin the business has a wallet for (GET /api/supported-coins) viaPOST /api/payments/create, plus PayPal viaPOST /api/paypal/payments/create.property,account_id,email,order_id. The CoinPay id is stored on the order as<rail>:<id>, because crypto confirmations and PayPal events carry only the payment id.X-CoinPay-Signature: t=..,v1=.., nested payload, order found by stored ref thenmetadata.order_id, unknown orders acked 200.available);/checkout/successand/checkout/canceladded.COINPAY_API_BASEnormalised (/apisuffix and the deadapi.host fold ontohttps://coinpayportal.com), so prod env needs no change.Tests:
vitest run485/485,bun run typecheckclean, prettier clean.🤖 Generated with Claude Code