Forem: IronixPay

Accept USDT Payments in Your Telegram Bot (Complete Guide)

IronixPay — Wed, 04 Mar 2026 08:14:06 +0000

Build a Telegram Bot that accepts USDT — from /buy command to on-chain confirmation — in under 20 minutes.

Telegram Bots are everywhere: VPN subscriptions, digital goods, SaaS tools, community memberships. But accepting payments? Stripe doesn't work inside Telegram. Traditional payment gateways add friction. Crypto payments solve this perfectly — and USDT (a dollar-pegged stablecoin) means your users don't need to worry about volatility.

In this guide, we'll build a Telegram Bot that:

Shows a product catalog with inline buttons
Creates payment sessions via IronixPay
Sends users a "Pay Now" link to a hosted checkout page
Receives a webhook when payment confirms on-chain
Sends a "✅ Payment confirmed!" message automatically

Tech stack: Node.js + grammY (Telegram Bot framework) + Express (webhook server)

💡 Full source code: github.com/IronixPay/ironixpay-examples/telegram-bot

1. Setup

mkdir my-tg-bot && cd my-tg-bot
npm init -y
npm install grammy express dotenv
npm install -D typescript tsx @types/express @types/node

Create a bot with @BotFather on Telegram → /newbot → copy the token.

Create .env:

BOT_TOKEN=123456:ABC-DEF...
IRONIXPAY_SECRET_KEY=sk_test_your_key_here
IRONIXPAY_API_URL=https://sandbox.ironixpay.com
IRONIXPAY_WEBHOOK_SECRET=whsec_your_secret_here
WEBHOOK_PORT=3000
PUBLIC_URL=https://your-domain.com

Get your IronixPay credentials at app.ironixpay.com → API Keys.

2. IronixPay API Helper

Create src/ironixpay.ts:

import crypto from "node:crypto";

const API_URL = process.env.IRONIXPAY_API_URL || "https://sandbox.ironixpay.com";
const SECRET_KEY = process.env.IRONIXPAY_SECRET_KEY || "";

export async function createCheckoutSession(params: {
    amount: number;      // Micro-units: 1 USDT = 1,000,000
    currency: "USDT";
    network: string;
    success_url: string;
    cancel_url: string;
    client_reference_id?: string;
}) {
    const res = await fetch(`${API_URL}/v1/checkout/sessions`, {
        method: "POST",
        headers: {
            Authorization: `Bearer ${SECRET_KEY}`,
            "Content-Type": "application/json",
        },
        body: JSON.stringify(params),
    });

    if (!res.ok) {
        const error = await res.json().catch(() => ({}));
        throw new Error(`IronixPay error (${res.status}): ${error.message || res.statusText}`);
    }
    return res.json();
}

export function verifyWebhookSignature(
    payload: string,
    signature: string,
    timestamp: string,
    secret: string
): boolean {
    // Reject requests older than 5 minutes (replay protection)
    const now = Math.floor(Date.now() / 1000);
    if (Math.abs(now - parseInt(timestamp)) > 300) return false;

    // IronixPay signs: "{timestamp}.{payload}"
    const message = `${timestamp}.${payload}`;
    const computed = crypto.createHmac("sha256", secret).update(message).digest("hex");

    if (computed.length !== signature.length) return false;

    return crypto.timingSafeEqual(
        Buffer.from(computed, "hex"),
        Buffer.from(signature, "hex")
    );
}

Key decisions:

Node.js crypto instead of Web Crypto API — synchronous, simpler for server-side
timingSafeEqual — prevents timing attacks on signature comparison
5-minute replay window — even if an attacker captures a webhook, they can't replay it later

3. The Bot

Create src/index.ts:

import { Bot, InlineKeyboard } from "grammy";
import { createCheckoutSession } from "./ironixpay.js";
import { startWebhookServer } from "./webhook-server.js";

const bot = new Bot(process.env.BOT_TOKEN!);
const PUBLIC_URL = process.env.PUBLIC_URL || "http://localhost:3000";

// Products (amounts in USDT micro-units)
const PRODUCTS = [
    { id: "starter", name: "⚡ Starter", price: 9_990_000 },   // $9.99
    { id: "pro",     name: "🚀 Pro",     price: 29_990_000 },  // $29.99
];

// In-memory order store (use a database in production!)
const pendingOrders = new Map<string, { chatId: number; productId: string }>();

// /buy — show product list
bot.command("buy", async (ctx) => {
    const kb = new InlineKeyboard();
    for (const p of PRODUCTS) {
        kb.text(`${p.name} — $${(p.price / 1_000_000).toFixed(2)}`, `buy:${p.id}`).row();
    }
    await ctx.reply("🛒 Choose a product:", { reply_markup: kb });
});

// User selects a product → create payment
bot.callbackQuery(/^buy:(.+)$/, async (ctx) => {
    const product = PRODUCTS.find(p => p.id === ctx.match[1]);
    if (!product) return ctx.answerCallbackQuery({ text: "Not found" });

    await ctx.answerCallbackQuery({ text: "Creating payment..." });

    try {
        const orderId = `tg_${ctx.from.id}_${Date.now()}`;
        const session = await createCheckoutSession({
            amount: product.price,
            currency: "USDT",
            network: "TRON",
            success_url: `${PUBLIC_URL}/success`,
            cancel_url: `${PUBLIC_URL}/cancel`,
            client_reference_id: orderId,
        });

        // Save order for webhook matching
        pendingOrders.set(orderId, { chatId: ctx.chat!.id, productId: product.id });

        const kb = new InlineKeyboard().url("💳 Pay Now", session.url);
        await ctx.editMessageText(
            `${product.name}\n💰 $${(product.price / 1_000_000).toFixed(2)} USDT\n\nClick below to pay:`,
            { reply_markup: kb }
        );
    } catch (error) {
        console.error("Payment error:", error);
        await ctx.editMessageText("❌ Failed to create payment. Try /buy again.");
    }
});

// Start webhook server + bot

startWebhookServer(bot, pendingOrders);
bot.start({ onStart: () => console.log("🤖 Bot is running!") });

The complete flow from the user's perspective:

User sends /buy → sees product buttons
User taps "⚡ Starter — $9.99" → bot creates IronixPay session
User taps "💳 Pay Now" → opens checkout page in browser
User sends USDT → IronixPay verifies on-chain
Bot sends "✅ Payment confirmed!" → done!

4. Webhook Server

Create src/webhook-server.ts:

import express from "express";
import type { Bot } from "grammy";
import { verifyWebhookSignature } from "./ironixpay.js";

export function startWebhookServer(
    bot: Bot,
    pendingOrders: Map<string, { chatId: number; productId: string }>
) {
    const app = express();
    app.use("/webhooks", express.text({ type: "application/json" }));

    app.post("/webhooks/ironixpay", async (req, res) => {
        const body = req.body as string;
        const sig = (req.headers["x-signature"] as string) || "";
        const ts = (req.headers["x-timestamp"] as string) || "";
        const secret = process.env.IRONIXPAY_WEBHOOK_SECRET || "";

        // Verify HMAC-SHA256 signature
        if (secret && !verifyWebhookSignature(body, sig, ts, secret)) {
            return res.status(401).json({ error: "Invalid signature" });
        }

        const event = JSON.parse(body);

        if (event.event_type === "session.completed") {
            const order = pendingOrders.get(event.data.client_reference_id);
            if (order) {
                const amount = (parseInt(event.data.amount_received) / 1_000_000).toFixed(2);
                await bot.api.sendMessage(order.chatId,
                    `✅ Payment confirmed!\n💰 $${amount} USDT received\n\nThank you! 🎉`
                );
                pendingOrders.delete(event.data.client_reference_id);
            }
        }

        res.json({ received: true });
    });

    const port = process.env.WEBHOOK_PORT || 3000;
    app.listen(port, () => console.log(`🌐 Webhook server on port ${port}`));
}

Why a separate Express server?

The bot uses long polling to receive Telegram messages. But IronixPay needs to push payment notifications to you via HTTP. So we run a small Express server alongside the bot on port 3000.

5. Test It

# Start the bot
npx tsx --require dotenv/config src/index.ts

Open Telegram → message your bot → /buy → pick a product → tap "Pay Now".

For local webhook testing, use a simulated curl:

curl -X POST http://localhost:3000/webhooks/ironixpay \
  -H "Content-Type: application/json" \
  -d '{"event_type":"session.completed","data":{"amount_received":"9990000","client_reference_id":"YOUR_ORDER_ID"}}'

For production webhook testing, expose your port with ngrok:

npx ngrok http 3000
# Set the ngrok URL as your webhook URL in the IronixPay dashboard

The Architecture

Telegram User          Your Server              IronixPay        Blockchain
     │                      │                       │                │
     │── /buy ─────────────▶│                       │                │
     │◀── Product buttons ──│                       │                │
     │── Tap "Starter" ────▶│                       │                │
     │                      │── Create session ────▶│                │
     │                      │◀── { url } ──────────│                │
     │◀── "Pay Now" button ─│                       │                │
     │                      │                       │                │
     │── Tap "Pay Now" ────▶│──── Opens checkout ──▶│                │
     │                      │                       │◀── USDT tx ────│
     │                      │                       │── Verify ─────▶│
     │                      │◀── Webhook ──────────│                │
     │◀── "✅ Confirmed!" ──│                       │                │

Going to Production

Switch credentials:

IRONIXPAY_SECRET_KEY=sk_live_...
IRONIXPAY_API_URL=https://api.ironixpay.com

Replace in-memory pendingOrders with Redis or PostgreSQL
Deploy the bot + webhook server behind a reverse proxy (Caddy/Nginx)
Set your webhook URL in the IronixPay dashboard

Production mode automatically supports all 7 networks (TRON, BSC, Ethereum, Polygon, Arbitrum, Optimism, Base).

Resources

IronixPay — Accept USDT on 7 blockchains with a single API. No Web3 knowledge required. Get started free →

Next.js + USDT: Add Crypto Payments to Your SaaS in 15 Minutes

IronixPay — Wed, 04 Mar 2026 08:12:56 +0000

Accept stablecoin payments on 7 blockchains with a single API call — no Web3 knowledge required.

If you're building a SaaS and want to accept USDT payments — whether it's for international customers dodging wire fees, crypto-native users, or markets where Stripe doesn't reach — this guide is for you.

We'll use IronixPay to add a Stripe-like checkout flow, except the payment happens on-chain. The integration pattern is almost identical: create a session on your server → redirect the user → receive a webhook when payment confirms.

What we'll build:

A Next.js API route that creates checkout sessions
A product page with a "Pay with USDT" button
A webhook handler that verifies signatures and processes payments
Success and cancel pages

Prerequisites: Node.js 18+, a free IronixPay account

💡 Full source code: github.com/IronixPay/ironixpay-examples

1. Project Setup

npx create-next-app@latest my-store --typescript --app
cd my-store

Create a .env.local file:

# Get your key at https://app.ironixpay.com → Dashboard → API Keys
IRONIXPAY_SECRET_KEY=sk_test_your_key_here
IRONIXPAY_API_URL=https://sandbox.ironixpay.com
NEXT_PUBLIC_APP_URL=http://localhost:3000

That's it for dependencies — we only need fetch, no extra packages.

2. The API Helper

Create src/lib/ironixpay.ts — a lightweight wrapper around the IronixPay API:

// src/lib/ironixpay.ts

export type Network =
  | "TRON" | "BSC" | "ETHEREUM"
  | "POLYGON" | "ARBITRUM" | "OPTIMISM" | "BASE";

export interface CreateSessionParams {
  amount: number;        // USDT micro-units (1 USDT = 1,000,000)
  currency: "USDT";
  network: Network;
  success_url: string;
  cancel_url: string;
  client_reference_id?: string;
}

export interface CheckoutSession {
  id: string;
  url: string;
  status: string;
  amount_expected: string;
  pay_address: string;
  expires_at: string;
}

const API_URL = process.env.IRONIXPAY_API_URL || "https://sandbox.ironixpay.com";
const SECRET_KEY = process.env.IRONIXPAY_SECRET_KEY || "";

export async function createCheckoutSession(
  params: CreateSessionParams
): Promise<CheckoutSession> {
  const res = await fetch(`${API_URL}/v1/checkout/sessions`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${SECRET_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(params),
  });

  if (!res.ok) {
    const error = await res.json().catch(() => ({}));
    throw new Error(
      `IronixPay API error (${res.status}): ${error.message || res.statusText}`
    );
  }

  return res.json();
}

Key concepts:

Micro-units: All amounts use the smallest unit. 10.50 USDT = 10_500_000. This avoids floating-point precision issues — the same approach Stripe uses with cents.
Server-side only: The secret key (sk_test_...) stays on your server. Never expose it to the client.
7 networks: TRON, BSC, Ethereum, Polygon, Arbitrum, Optimism, Base. Users pay on their preferred chain.

3. The Checkout API Route

Create src/app/api/checkout/route.ts:

// src/app/api/checkout/route.ts
import { NextResponse } from "next/server";
import { createCheckoutSession } from "@/lib/ironixpay";
import type { Network } from "@/lib/ironixpay";

export async function POST(request: Request) {
  try {
    const { amount, network = "TRON" } = await request.json() as {
      amount: number;
      network?: Network;
    };

    // Validate: minimum 1 USDT
    if (!amount || amount < 1_000_000) {
      return NextResponse.json(
        { error: "Amount must be at least 1 USDT" },
        { status: 400 }
      );
    }

    const appUrl = process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000";

    const session = await createCheckoutSession({
      amount,
      currency: "USDT",
      network,
      success_url: `${appUrl}/success`,
      cancel_url: `${appUrl}/cancel`,
      client_reference_id: `order_${Date.now()}`,
    });

    return NextResponse.json({ id: session.id, url: session.url });
  } catch (error) {
    console.error("Checkout error:", error);
    return NextResponse.json(
      { error: error instanceof Error ? error.message : "Internal error" },
      { status: 500 }
    );
  }
}

This is the equivalent of Stripe's stripe.checkout.sessions.create(). The response includes a url that you redirect the user to.

4. The Product Page

Create your checkout page in src/app/page.tsx:

"use client";
import { useState } from "react";

export default function Home() {
  const [loading, setLoading] = useState(false);

  const handleCheckout = async () => {
    setLoading(true);

    try {
      const res = await fetch("/api/checkout", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          amount: 9_990_000,  // 9.99 USDT (always use integers, not 9.99 * 1_000_000)
          network: "TRON",
        }),
      });

      const data = await res.json();
      if (!res.ok) throw new Error(data.error);

      window.location.href = data.url;  // Redirect to IronixPay checkout
    } catch (err) {
      alert(err instanceof Error ? err.message : "Payment failed");
      setLoading(false);
    }
  };

  return (
    <main style={{ maxWidth: 480, margin: "80px auto", textAlign: "center" }}>
      <h1>My SaaS Product</h1>
      <p>Pro Plan — $9.99/month</p>
      <button onClick={handleCheckout} disabled={loading}>
        {loading ? "Redirecting..." : "Pay $9.99 USDT"}
      </button>
    </main>
  );
}

When the user clicks "Pay", we:

Call our API route (server-side, secret key safe)
Get back a hosted checkout URL
Redirect — IronixPay shows a payment page with QR code and address
The user pays with any TRON wallet (TronLink, Trust Wallet, etc.)

5. Handling Webhooks

This is where the real work happens. After the user pays, IronixPay sends a webhook to confirm the payment is settled on-chain.

Create src/app/api/webhooks/ironixpay/route.ts:

// src/app/api/webhooks/ironixpay/route.ts
import { NextResponse } from "next/server";

export async function POST(request: Request) {
  const body = await request.text();
  const signature = request.headers.get("x-signature") || "";
  const timestamp = request.headers.get("x-timestamp") || "";
  const secret = process.env.IRONIXPAY_WEBHOOK_SECRET || "";

  // Step 1: Verify HMAC-SHA256 signature
  if (secret) {
    const isValid = await verifySignature(body, signature, timestamp, secret);
    if (!isValid) {
      return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
    }
  }

  // Step 2: Parse and handle the event
  const event = JSON.parse(body);

  // Webhook event types:
  // - session.completed — Payment confirmed on-chain
  // - session.expired   — Session timed out
  switch (event.event_type) {
    case "session.completed":
      // ✅ Payment is confirmed on-chain — fulfill the order!
      const { id, amount_received, client_reference_id } = event.data;
      console.log(`Payment ${id} confirmed: ${amount_received} micro-units`);
      // TODO: Update your database, activate the subscription, send email
      break;

    case "session.expired":
      // ⏰ Session timed out — no payment received
      console.log(`Session ${event.data.id} expired`);
      break;
  }

  return NextResponse.json({ received: true });
}

// HMAC-SHA256 verification
async function verifySignature(
  payload: string, signature: string, timestamp: string, secret: string
): Promise<boolean> {
  // Reject requests older than 5 minutes (replay protection)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) return false;

  const encoder = new TextEncoder();
  const key = await crypto.subtle.importKey(
    "raw", encoder.encode(secret),
    { name: "HMAC", hash: "SHA-256" }, false, ["sign"]
  );

  // IronixPay signs: "{timestamp}.{payload}"
  const message = `${timestamp}.${payload}`;
  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
  const computed = Array.from(new Uint8Array(sig))
    .map(b => b.toString(16).padStart(2, "0")).join("");

  return computed === signature;
}

Why verify signatures?

Without verification, anyone could POST fake "payment confirmed" events to your webhook URL. The HMAC-SHA256 signature ensures the request came from IronixPay.

IronixPay uses the pattern HMAC(secret, timestamp + "." + body) — binding the timestamp prevents replay attacks where an attacker resends a captured webhook.

6. Success & Cancel Pages

// src/app/success/page.tsx
export default function SuccessPage() {
  return (
    <main style={{ maxWidth: 480, margin: "80px auto", textAlign: "center" }}>
      <h1>✅ Payment Successful!</h1>
      <p>Your USDT payment has been confirmed on-chain.</p>
      <a href="/">Back to Store</a>
    </main>
  );
}

// src/app/cancel/page.tsx
export default function CancelPage() {
  return (
    <main style={{ maxWidth: 480, margin: "80px auto", textAlign: "center" }}>
      <h1>⏰ Payment Cancelled</h1>
      <p>The session expired. No payment was processed.</p>
      <a href="/">Try Again</a>
    </main>
  );
}

7. Test It

npm run dev
# Open http://localhost:3000
# Click "Pay" → you'll be redirected to the IronixPay checkout page

In sandbox mode, the checkout page shows a TRON testnet address. You can send test TRX/USDT from a Nile faucet to simulate a payment.

The Complete Flow

Your App                    IronixPay                   Blockchain
  │                            │                            │
  │── POST /api/checkout ────▶│                            │
  │                            │── Creates session ───────▶│
  │◀── { url } ───────────────│                            │
  │                            │                            │
  │── Redirect user ─────────▶│                            │
  │                            │── Shows QR / address ────▶│
  │                            │                            │
  │                            │◀── USDT transfer ─────────│
  │                            │── Verifies on-chain ─────▶│
  │                            │                            │
  │◀── Webhook: completed ────│                            │
  │── Fulfill order            │                            │
  │── Redirect to /success     │                            │

Going to Production

Three changes:

IRONIXPAY_SECRET_KEY=sk_live_your_production_key
IRONIXPAY_API_URL=https://api.ironixpay.com
IRONIXPAY_WEBHOOK_SECRET=whsec_your_webhook_secret

That's it. Same code, real money.

Why USDT?

	Credit Card (Stripe)	USDT (IronixPay)
Fees	2.9% + $0.30	1% flat
Settlement	2-7 days	Instant
Chargebacks	Yes (fraud risk)	Impossible
Global reach	Limited by country	Anyone with a wallet
KYC required	For merchant	No

For a $100 payment: Stripe takes $3.20, IronixPay takes $1.00. At scale, that difference compounds.

Resources

📖 IronixPay Docs
🧑‍💻 Full source code (GitHub)
💬 Questions? Telegram

IronixPay supports USDT on TRON, BSC, Ethereum, Polygon, Arbitrum, Optimism, and Base — all through a single API. Get started free →

Accept USDT Payments in 5 Minutes — Node.js Tutorial

IronixPay — Sat, 21 Feb 2026 14:57:16 +0000

You want to accept USDT on your website, SaaS app, or Telegram bot. You don't want to deal with blockchain nodes, wallet management, or building a checkout page from scratch.

This tutorial gets you from zero to a working USDT checkout in under 5 minutes, using IronixPay — a payment gateway for USDT on TRON.

What you'll build: A payment flow where your customer clicks "Pay", sees a checkout page with a TRON address + QR code, sends USDT, and your server gets a webhook when the payment confirms on-chain.

What You Need

Node.js v18+
An IronixPay account → Sign up free

That's it. No blockchain node. No wallet. No smart contract.

Step 1: Get Your API Key

Log in to the IronixPay Dashboard
Go to API Keys in the sidebar
Click Create Key → copy it (starts with sk_test_)

💡 Use sk_test_ keys for development (TRON Nile testnet, free test USDT). Switch to sk_live_ for real payments.

Step 2: Create a Checkout Session (Backend)

Your backend creates a session, which generates a unique payment address and checkout URL.

// server.js
const express = require('express');
const app = express();
app.use(express.json());

const IRONIXPAY_SECRET = process.env.IRONIXPAY_SECRET_KEY; // sk_test_...

app.post('/create-checkout', async (req, res) => {
  const response = await fetch(
    'https://sandbox.ironixpay.com/v1/checkout/sessions',
    {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${IRONIXPAY_SECRET}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        amount: 10000000, // 10.00 USDT (micro-units: 1 USDT = 1,000,000)
        currency: 'USDT',
        network: 'TRON',
        success_url: 'https://yoursite.com/success',
        cancel_url: 'https://yoursite.com/cancel',
        client_reference_id: req.body.orderId,
      }),
    }
  );

  const session = await response.json();
  res.json({ id: session.id, url: session.url });
});

app.listen(3000, () => console.log('Server running on :3000'));

The response gives you:

url — hosted checkout page with QR code and payment address
id — session ID (e.g. cs_abc123...) for tracking

⚠️ Never expose sk_test_ or sk_live_ keys in frontend code. Always create sessions from your backend.

Step 3: Send Your Customer to Checkout

document.getElementById('pay-btn').addEventListener('click', async () => {
  const res = await fetch('/create-checkout', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ orderId: 'order_001' }),
  });
  const { url } = await res.json();
  window.location.href = url; // → IronixPay checkout page
});

<button id="pay-btn">Pay 10 USDT</button>

💡 Want to embed the checkout inside your own page? Use the @ironix-pay/sdk — see the Embed Mode guide.

Step 4: Receive the Webhook

When your customer pays, IronixPay sends a session.completed webhook:

const crypto = require('crypto');
const WEBHOOK_SECRET = process.env.IRONIXPAY_WEBHOOK_SECRET; // whsec_...

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-signature'];
  const timestamp = req.headers['x-timestamp'];
  const payload = req.body.toString();

  // 1. Verify signature
  const message = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(message)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('Invalid signature');
  }

  // 2. Check timestamp (5-min window)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(401).send('Timestamp expired');
  }

  // 3. Process the event
  const event = JSON.parse(payload);
  if (event.event_type === 'session.completed') {
    const { session_id, amount_received } = event.data;
    console.log(`✅ Payment received! Session: ${session_id}, Amount: ${amount_received / 1_000_000} USDT`);
    // TODO: Mark order as paid in your database
  }

  res.status(200).send('OK');
});

💡 Go to Dashboard → Developer → Webhooks to set your endpoint URL and copy the signing secret.

Complete Working Example

Copy-paste this server.js:

require('dotenv').config();
const express = require('express');
const crypto = require('crypto');
const app = express();

const SECRET_KEY = process.env.IRONIXPAY_SECRET_KEY;
const WEBHOOK_SECRET = process.env.IRONIXPAY_WEBHOOK_SECRET;
const API_BASE = 'https://sandbox.ironixpay.com';

app.use('/public', express.static('public'));
app.use(express.json());

app.post('/create-checkout', async (req, res) => {
  const response = await fetch(`${API_BASE}/v1/checkout/sessions`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${SECRET_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      amount: req.body.amount || 10000000,
      currency: 'USDT',
      network: 'TRON',
      success_url: `http://localhost:3000/public/success.html`,
      cancel_url: `http://localhost:3000/public/cancel.html`,
      client_reference_id: req.body.orderId,
    }),
  });
  const session = await response.json();
  res.json({ id: session.id, url: session.url });
});

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-signature'];
  const ts = req.headers['x-timestamp'];
  const body = req.body.toString();

  const expected = crypto.createHmac('sha256', WEBHOOK_SECRET)
    .update(`${ts}.${body}`).digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(401).send('Bad signature');
  }

  const event = JSON.parse(body);
  console.log(`[Webhook] ${event.event_type}:`, JSON.stringify(event.data, null, 2));

  if (event.event_type === 'session.completed') {
    console.log(`💰 Order paid: ${event.data.amount_received / 1e6} USDT`);
  }

  res.sendStatus(200);
});

app.listen(3000, () => console.log('🚀 http://localhost:3000'));

# .env
IRONIXPAY_SECRET_KEY=sk_test_your_key_here
IRONIXPAY_WEBHOOK_SECRET=whsec_your_secret_here

npm install express dotenv
node server.js

Telegram Bot? Same API.

bot.onText(/\/pay/, async (msg) => {
  const res = await fetch(`${API_BASE}/v1/checkout/sessions`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${SECRET_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      amount: 5000000,
      currency: 'USDT',
      network: 'TRON',
      success_url: 'https://t.me/your_bot',
      cancel_url: 'https://t.me/your_bot',
    }),
  });
  const session = await res.json();

  bot.sendMessage(msg.chat.id, `💳 Pay 5 USDT to complete your order:`, {
    reply_markup: {
      inline_keyboard: [[{ text: '🔗 Pay Now', url: session.url }]],
    },
  });
});

What Happens Behind the Scenes

Your app creates session → IronixPay generates unique TRON address
                                    ↓
        Customer sends USDT → on-chain transaction detected
                                    ↓
              IronixPay confirms → webhook fired to your server
                                    ↓
           USDT auto-swept to your treasury wallet 💰

You never touch a private key. You never run a blockchain node. IronixPay handles HD wallet derivation, transaction monitoring, and fund sweeping.

Learn More

📖 Full API Reference
🧪 Testing Guide — sandbox environment
🎨 Embed Mode (SDK) — embed checkout in your page
🕹️ Live Demo — try the checkout experience

Built with ❤️ by IronixPay — USDT payment gateway for developers.