Keep keys on the server
Create orders from Node.js so private API keys and local cart validation stay out of browser code.
A production USDT checkout needs more than a wallet address. Create an order from Node.js, return checkout data to the browser, then fulfill only after a verified on-chain payment webhook.
import express from 'express'
const app = express()
app.use(express.json())
app.post('/api/checkout', async (req, res) => {
const response = await fetch('https://api.boltutil.com/api/v1/order/create', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-Bolt-Key': process.env.BOLTUTIL_API_KEY
},
body: JSON.stringify({
externalOrderId: req.body.orderId,
amount: req.body.amount,
currency: 'USDT',
network: 'TRC20',
notifyUrl: 'https://merchant.com/webhooks/boltutil',
returnUrl: 'https://merchant.com/orders/complete'
})
})
res.status(response.status).json(await response.json())
})Use this pattern for SaaS subscriptions, digital delivery, invoices, account credits, or any website that needs an auditable USDT payment state.
Create and persist a unique internal order ID before calling the payment API.
Call the BoltUtil create-order endpoint from your Node.js backend and return the checkout URL to the browser.
Show the exact USDT network and amount. A browser redirect is not payment proof.
Verify the raw webhook body and signature, then fulfill idempotently by order ID and transaction hash.
Store the confirmed transaction hash, network, amount, and fulfillment result for support and reconciliation.
Create orders from Node.js so private API keys and local cart validation stay out of browser code.
Customers pay the configured merchant wallet while BoltUtil monitors the selected USDT network and reports confirmation.
A signed server-to-server webhook lets your application activate access or delivery without trusting a customer redirect.
Integration notes
Customers can return early or submit a transaction that fails. Use a verified webhook or server-side order-status query as the source of truth.
USDT exists on multiple networks. Display TRC20, ERC20, BEP20, Polygon, or Solana clearly and match only the network chosen when creating the order.
Keep the external order ID, transaction hash, exact amount, destination address, and confirmation state for fast reconciliation.
These answers help developers, founders, and support teams understand the payment lifecycle before accepting real USDT payments.
Do not expose a private API key in browser code. Create orders from your Node.js server, validate the local cart or invoice there, and return only checkout data to the client.
Grant access only after a signed webhook is verified or a trusted server-side status query confirms completion. A return URL is not payment evidence.
Make fulfillment idempotent. Store the external order ID and transaction hash with a unique constraint or transactional state transition, then safely ignore duplicate deliveries.
Choose the network your customers can reliably use and make it explicit. BoltUtil supports TRC20, ERC20, BEP20, Polygon, and Solana with the same order API.
Create orders, monitor transfers, and notify your backend without asking customers to send screenshots.
Create free account