USDT / USDC 支付接口 · 订单 API 与回调验签

import crypto from 'node:crypto'

// Node.js 20+ server module. Call only after authenticating the buyer.
// order must come from your database, with ownership and price checked.
// Never pass req.body directly; persist externalOrderId before calling.
export async function createStablecoinCheckout(order) {
  const key = process.env.BOLTUTIL_API_KEY
  const secret = process.env.BOLTUTIL_API_SECRET
  if (!key || !secret) throw new Error('Missing server credentials')

  const payload = JSON.stringify({
    externalOrderId: order.externalOrderId,
    amount: order.amount,
    currency: 'USDC',
    network: 'BASE',
    notifyUrl: 'https://merchant.com/webhooks/boltutil',
    returnUrl: 'https://merchant.com/orders/complete'
  })
  const timestamp = Date.now().toString()
  const signature = crypto.createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`).digest('hex')

  // A timeout does not prove creation failed. Query order/status using
  // the SAME externalOrderId before deciding whether to retry.
  const response = await fetch('https://api.boltutil.com/api/v1/order/create', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Bolt-Key': key,
      'X-Bolt-Timestamp': timestamp,
      'X-Bolt-Signature': signature
    },
    body: payload,
    signal: AbortSignal.timeout(10000)
  })
  const result = await response.json()
  if (!response.ok || result.code !== 200 || !result.data?.checkoutUrl) {
    throw new Error('Create order failed; reconcile the saved order')
  }
  // Save result.data on the server. Return only checkout data to the buyer.
  return result.data
}

此处为服务端接入示例，不会发送请求。实际调用需 API Key、时间戳与请求原文签名，并校验本地订单和价格。