// CryptoLink receives zpub from merchant during setup
// (xpub and ypub also accepted — auto-converted internally)
zpub := "zpub6rFR7y4Q2A...your_key..."

// For each new payment, derive the next index
paymentIndex := db.GetNextAddressIndex(merchantID)

// Derive child public key using BIP32 (path: m/84'/0'/0'/0/{index})
childKey := bip32.DeriveChildKey(zpub, paymentIndex)

// Convert to Bitcoin bech32 address
address := bitcoin.PublicKeyToBech32Address(childKey)
// Result: "bc1q3a2d8f..." — a fresh, unique Native SegWit address
// This address belongs to the merchant's HD wallet
// ONLY the merchant's private key (in their hardware wallet) can sign from it

curl -X POST https://yourdomain.com/api/merchant/v1/merchant/{merchantId}/payment \
  -H "Content-Type: application/json" \
  -H "X-CRYPTOLINK-TOKEN: your_api_token_here" \
  -d '{
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "currency": "USD",
    "price": 50.00,
    "orderId": "order_001",
    "description": "Test payment",
    "redirectUrl": "https://yourstore.com/thank-you"
  }'

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "paymentURL": "https://yourdomain.com/p/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "pending",
  "price": "50.00",
  "currency": "USD",
  "orderId": "order_001",
  "type": "payment"
}

<?php
// Verify webhook signature
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$body = file_get_contents('php://input');
$secret = getenv('CRYPTOLINK_HMAC_SECRET');

$expected = base64_encode(hash_hmac('sha512', $body, $secret, true));

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$payload = json_decode($body, true);

if ($payload['status'] === 'success') {
    // Fulfill the order using merchantOrderID (your orderId from payment creation)
    fulfillOrder($payload['merchantOrderID']);
}

http_response_code(200);
echo 'OK';

curl https://yourdomain.com/api/merchant/v1/merchant/{merchantId}/payment \
  -H "X-CRYPTOLINK-TOKEN: cl_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

https://yourdomain.com/api/merchant/v1/merchant/{merchantId}

https://yourdomain.com/api/merchant/v1/merchant/550e8400-e29b-41d4-a716-446655440000/payment

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "currency": "USD",
  "price": 100.00,
  "orderId": "order_123",
  "description": "Payment for Order #123",
  "redirectUrl": "https://yourstore.com/thank-you"
}

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "paymentURL": "https://yourdomain.com/p/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "pending",
  "price": "100.00",
  "currency": "USD",
  "orderId": "order_123",
  "description": "Payment for Order #123",
  "type": "payment",
  "createdAt": "2025-06-01T14:30:00Z"
}

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "paymentURL": "https://yourdomain.com/p/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "success",
  "price": "100.00",
  "currency": "USD",
  "orderId": "order_123",
  "description": "Payment for Order #123",
  "type": "payment",
  "createdAt": "2025-06-01T14:30:00Z"
}

{
  "name": "Donation Link",
  "description": "Support our open-source project",
  "currency": "USDT_TRON",
  "redirect_url": "https://example.com/thank-you",
  "successMessage": "Thank you for your payment!"
}

{
  "id": "7f3a9b2c-1234-5678-abcd-ef0123456789",
  "url": "https://yourdomain.com/p/7f3a9b2c-1234-5678-abcd-ef0123456789",
  "name": "Donation Link",
  "description": "Support our open-source project",
  "currency": "USDT_TRON",
  "status": "active",
  "total_payments": 0,
  "total_amount_usd": "0.00",
  "created_at": "2025-06-01T12:00:00Z"
}

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "success",
  "merchantOrderID": "order_123",
  "amount": "100.00",
  "currency": "USD",
  "cryptoAmount": "107.24",
  "cryptoCurrency": "ETH_USDT",
  "selectedBlockchain": "ETH",
  "customerEmail": "[email protected]",
  "isTest": false,
  "linkId": null
}

curl -X POST https://yourdomain.com/api/merchant/v1/merchant/{merchantId}/xpub-wallet \
  -H "Content-Type: application/json" \
  -H "X-CRYPTOLINK-TOKEN: your_api_token" \
  -d '{
    "blockchain": "BTC",
    "xpub": "zpub6rFR7y4Q2AijBEqTUqiGMcA8k3KNBNzihkghGjRjkTLmBgR..."
  }'

{
  "uuid": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "blockchain": "BTC",
  "derivationPath": "m/84'/0'/0'",
  "lastDerivedIndex": -1,
  "createdAt": "2026-03-14T12:00:00Z"
}

[
  {
    "uuid": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "blockchain": "BTC",
    "derivationPath": "m/84'/0'/0'",
    "lastDerivedIndex": 5,
    "createdAt": "2026-03-14T12:00:00Z"
  }
]

{
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "address": "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
  "derivationPath": "m/84'/0'/0'/0/0",
  "derivationIndex": 0,
  "isUsed": false,
  "createdAt": "2026-03-14T12:01:00Z"
}

[
  {
    "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "address": "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
    "derivationPath": "m/84'/0'/0'/0/0",
    "derivationIndex": 0,
    "isUsed": true,
    "createdAt": "2026-03-14T12:01:00Z"
  },
  {
    "uuid": "b2c3d4e5-f678-9012-bcde-f12345678901",
    "address": "bc1q9h5yjda0hs9ftlg3f0lm45rg9kpa9wfvyaalqq",
    "derivationPath": "m/84'/0'/0'/0/1",
    "derivationIndex": 1,
    "isUsed": false,
    "createdAt": "2026-03-14T12:02:00Z"
  }
]

CRYPTOLINK_BASE_URL=https://yourdomain.com
CRYPTOLINK_MERCHANT_ID=your-merchant-uuid-from-dashboard
CRYPTOLINK_API_TOKEN=cl_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
CRYPTOLINK_HMAC_SECRET=your_hmac_secret_from_dashboard_settings

<?php

namespace App\Services;

use Illuminate\Http\Client\Response;
use Illuminate\Support\Facades\Http;

class CryptoLinkService
{
    private string $baseUrl;
    private string $merchantId;
    private string $apiToken;
    private string $hmacSecret;

    public function __construct()
    {
        $this->baseUrl    = config('services.cryptolink.base_url');
        $this->merchantId = config('services.cryptolink.merchant_id');
        $this->apiToken   = config('services.cryptolink.api_token');
        $this->hmacSecret = config('services.cryptolink.hmac_secret');
    }

    /**
     * Create a new crypto payment.
     *
     * @param array $params Keys: id (UUID), currency (USD/EUR), price, orderId, description, redirectUrl
     */
    public function createPayment(array $params): array
    {
        $url = "{$this->baseUrl}/api/merchant/v1/merchant/{$this->merchantId}/payment";

        $response = Http::withHeaders([
            'X-CRYPTOLINK-TOKEN' => $this->apiToken,
            'Content-Type'       => 'application/json',
        ])->post($url, [
            'id'          => $params['id'],           // UUID v4 you generate
            'currency'    => $params['currency'],      // "USD" or "EUR"
            'price'       => $params['price'],         // float e.g. 99.99
            'orderId'     => $params['orderId'] ?? null,
            'description' => $params['description'] ?? null,
            'redirectUrl' => $params['redirectUrl'] ?? null,
            'isTest'      => $params['isTest'] ?? false,
        ]);

        if ($response->failed()) {
            throw new \RuntimeException(
                'CryptoLink API error: ' . $response->body(),
                $response->status()
            );
        }

        return $response->json();
    }

    /**
     * Retrieve an existing payment by its UUID.
     */
    public function getPayment(string $paymentId): array
    {
        $url = "{$this->baseUrl}/api/merchant/v1/merchant/{$this->merchantId}/payment/{$paymentId}";

        $response = Http::withHeaders([
            'X-CRYPTOLINK-TOKEN' => $this->apiToken,
        ])->get($url);

        if ($response->failed()) {
            throw new \RuntimeException('Payment not found', 404);
        }

        return $response->json();
    }

    /**
     * Verify a webhook signature (X-Signature header).
     * Returns true if the signature is valid.
     */
    public function verifyWebhookSignature(string $rawBody, string $signature): bool
    {
        $expected = base64_encode(
            hash_hmac('sha512', $rawBody, $this->hmacSecret, true)
        );
        return hash_equals($expected, $signature);
    }
}

'cryptolink' => [
    'base_url'    => env('CRYPTOLINK_BASE_URL'),
    'merchant_id' => env('CRYPTOLINK_MERCHANT_ID'),
    'api_token'   => env('CRYPTOLINK_API_TOKEN'),
    'hmac_secret' => env('CRYPTOLINK_HMAC_SECRET'),
],

<?php

namespace App\Http\Controllers;

use App\Models\Order;
use App\Services\CryptoLinkService;
use Illuminate\Http\Request;

class CheckoutController extends Controller
{
    public function __construct(private CryptoLinkService $cryptoLink) {}

    /**
     * Initiate crypto checkout for an order.
     */
    public function initiateCryptoPayment(Request $request, Order $order)
    {
        try {
            $payment = $this->cryptoLink->createPayment([
                'id'          => \Ramsey\Uuid\Uuid::uuid4()->toString(), // unique per payment
                'currency'    => 'USD',       // or 'EUR' — fiat currency of invoice
                'price'       => $order->total_usd,
                'orderId'     => (string) $order->id,
                'description' => "Order #{$order->id} — {$order->item_summary}",
                'redirectUrl' => route('orders.thankyou', $order),
            ]);

            // Store the payment ID on the order for lookup later
            $order->update([
                'crypto_payment_id'  => $payment['id'],
                'crypto_payment_url' => $payment['paymentURL'],
                'status'             => 'awaiting_payment',
            ]);

            // Redirect customer to the CryptoLink-hosted payment page
            return redirect($payment['paymentURL']);

        } catch (\RuntimeException $e) {
            return back()->withErrors(['payment' => 'Could not initiate payment: ' . $e->getMessage()]);
        }
    }
}

<?php

namespace App\Http\Controllers;

use App\Models\Order;
use App\Services\CryptoLinkService;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;

class WebhookController extends Controller
{
    public function __construct(private CryptoLinkService $cryptoLink) {}

    public function handleCryptoLink(Request $request)
    {
        $rawBody   = $request->getContent();
        $signature = $request->header('X-Signature', '');

        // 1. Verify signature
        if (!$this->cryptoLink->verifyWebhookSignature($rawBody, $signature)) {
            Log::warning('CryptoLink: invalid webhook signature');
            return response()->json(['error' => 'Invalid signature'], 401);
        }

        $event   = $request->json()->all();
        $orderId = $event['merchantOrderID'] ?? null; // your orderId from payment creation

        if (!$orderId) {
            return response()->json(['received' => true]);
        }

        $order = Order::find($orderId);
        if (!$order) {
            Log::error("CryptoLink webhook: order {$orderId} not found");
            return response()->json(['error' => 'Order not found'], 404);
        }

        // 2. Handle event (idempotent — check current status first)
        switch ($event['status']) {
            case 'success':
                if ($order->status !== 'completed') {
                    $order->update(['status' => 'completed']);
                    $order->fulfill(); // your fulfillment logic
                    Log::info("CryptoLink: order {$orderId} fulfilled", $event);
                }
                break;

            case 'inProgress':
                $order->update(['status' => 'payment_processing']);
                break;

            case 'failed':
                $order->update(['status' => 'payment_failed']);
                break;
        }

        return response()->json(['received' => true]);
    }
}

<?php
use App\Http\Controllers\CheckoutController;
use App\Http\Controllers\WebhookController;

// Checkout — requires auth
Route::middleware('auth')->group(function () {
    Route::post('/orders/{order}/pay-crypto', [CheckoutController::class, 'initiateCryptoPayment'])
        ->name('checkout.crypto');
});

// Webhook — must be CSRF-exempt
Route::post('/webhooks/cryptolink', [WebhookController::class, 'handleCryptoLink'])
    ->name('webhooks.cryptolink')
    ->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);

npm install axios express dotenv

const axios  = require('axios');
const crypto = require('crypto');

class CryptoLinkClient {
    constructor({ baseUrl, merchantId, apiToken, hmacSecret }) {
        this.hmacSecret = hmacSecret;
        this.http = axios.create({
            baseURL: `${baseUrl}/api/merchant/v1/merchant/${merchantId}`,
            headers: {
                'X-CRYPTOLINK-TOKEN': apiToken,
                'Content-Type': 'application/json',
            },
            timeout: 15000,
        });
    }

    async createPayment(params) {
        const { data } = await this.http.post('/payment', {
            id:          params.id,          // UUID v4 you generate
            currency:    params.currency,    // 'USD' or 'EUR'
            price:       params.price,       // number e.g. 99.99
            orderId:     params.orderId,
            description: params.description,
            redirectUrl: params.redirectUrl,
            isTest:      params.isTest || false,
        });
        return data;
    }

    async getPayment(paymentId) {
        const { data } = await this.http.get(`/payment/${paymentId}`);
        return data;
    }

    verifyWebhookSignature(rawBody, signature) {
        const expected = crypto
            .createHmac('sha512', this.hmacSecret)
            .update(rawBody)
            .digest('base64');
        try {
            return crypto.timingSafeEqual(
                Buffer.from(expected, 'utf8'),
                Buffer.from(signature, 'utf8')
            );
        } catch {
            return false;
        }
    }
}

module.exports = CryptoLinkClient;

require('dotenv').config();
const express = require('express');
const router  = express.Router();
const CryptoLinkClient = require('../cryptolink');

const cl = new CryptoLinkClient({
    baseUrl:    process.env.CRYPTOLINK_BASE_URL,
    merchantId: process.env.CRYPTOLINK_MERCHANT_ID,
    apiToken:   process.env.CRYPTOLINK_API_TOKEN,
    hmacSecret: process.env.CRYPTOLINK_HMAC_SECRET,
});

// POST /checkout/crypto — initiate payment
router.post('/checkout/crypto', async (req, res) => {
    const { orderId } = req.body;
    const order = await Order.findById(orderId);
    if (!order) return res.status(404).json({ error: 'Order not found' });

    const payment = await cl.createPayment({
        id:          require('crypto').randomUUID(), // unique per payment
        currency:    'USD',   // or 'EUR'
        price:       order.totalUsd,
        orderId:     order.id.toString(),
        description: `Order #${order.id}`,
        redirectUrl: `${process.env.APP_URL}/orders/${order.id}/thank-you`,
    });

    await Order.findByIdAndUpdate(orderId, {
        cryptoPaymentId: payment.id,
        status: 'awaiting_payment',
    });

    res.redirect(payment.paymentURL);
});

// POST /webhooks/cryptolink — must use express.raw()
router.post('/webhooks/cryptolink',
    express.raw({ type: 'application/json' }),
    async (req, res) => {
        const signature = req.headers['x-signature'] || '';
        if (!cl.verifyWebhookSignature(req.body, signature)) {
            return res.status(401).json({ error: 'Invalid signature' });
        }
        const event = JSON.parse(req.body.toString());
        if (event.status === 'success') {
            await fulfillOrder(event.merchantOrderID); // your orderId
        }
        res.status(200).json({ received: true });
    }
);

module.exports = router;

APP_URL=https://yourstore.com
CRYPTOLINK_BASE_URL=https://yourdomain.com
CRYPTOLINK_MERCHANT_ID=your-merchant-uuid-from-dashboard
CRYPTOLINK_API_TOKEN=cl_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
CRYPTOLINK_HMAC_SECRET=your_hmac_secret_from_dashboard_settings

pip install requests flask python-dotenv

import hmac
import hashlib
import base64
import requests
from typing import Optional


class CryptoLinkClient:
    def __init__(self, base_url: str, merchant_id: str, api_token: str, hmac_secret: str):
        self.hmac_secret = hmac_secret
        self._base = f"{base_url.rstrip('/')}/api/merchant/v1/merchant/{merchant_id}"
        self.session = requests.Session()
        self.session.headers.update({
            "X-CRYPTOLINK-TOKEN": api_token,
            "Content-Type": "application/json",
        })

    def create_payment(self, payment_id: str, currency: str, price: float,
                        order_id: str = None, description: str = None,
                        redirect_url: str = None, is_test: bool = False) -> dict:
        """Create a payment. currency must be 'USD' or 'EUR'."""
        payload = {
            "id":       payment_id,  # UUID v4 you generate for idempotency
            "currency": currency,    # 'USD' or 'EUR'
            "price":    price,       # float e.g. 99.99
            "isTest":   is_test,
        }
        if order_id:    payload["orderId"]     = order_id
        if description: payload["description"] = description
        if redirect_url: payload["redirectUrl"] = redirect_url
        resp = self.session.post(f"{self._base}/payment", json=payload)
        resp.raise_for_status()
        return resp.json()

    def get_payment(self, payment_id: str) -> dict:
        resp = self.session.get(f"{self._base}/payment/{payment_id}")
        resp.raise_for_status()
        return resp.json()

    def verify_webhook(self, raw_body: bytes, signature: str) -> bool:
        mac = hmac.new(self.hmac_secret.encode("utf-8"), raw_body, hashlib.sha512)
        expected = base64.b64encode(mac.digest()).decode("utf-8")
        return hmac.compare_digest(expected, signature)

import os
import logging
from flask import Flask, request, jsonify, redirect, abort
from cryptolink import CryptoLinkClient

app = Flask(__name__)
log = logging.getLogger(__name__)

import uuid as uuid_lib

cl = CryptoLinkClient(
    base_url    = os.environ["CRYPTOLINK_BASE_URL"],
    merchant_id = os.environ["CRYPTOLINK_MERCHANT_ID"],
    api_token   = os.environ["CRYPTOLINK_API_TOKEN"],
    hmac_secret = os.environ["CRYPTOLINK_HMAC_SECRET"],
)

APP_URL = os.environ["APP_URL"]


@app.route("/checkout/crypto", methods=["POST"])
def initiate_crypto_payment():
    data     = request.get_json()
    order_id = data.get("order_id")
    order    = get_order(order_id)
    if not order:
        abort(404)

    payment = cl.create_payment(
        payment_id   = str(uuid_lib.uuid4()),  # unique per payment
        currency     = "USD",  # or "EUR"
        price        = order["total_usd"],
        order_id     = str(order["id"]),
        description  = f'Order #{order["id"]}',
        redirect_url = f'{APP_URL}/orders/{order["id"]}/thank-you',
    )
    update_order(order_id, {"crypto_payment_id": payment["id"], "status": "awaiting_payment"})
    return jsonify({"redirect_url": payment["paymentURL"]})


@app.route("/webhooks/cryptolink", methods=["POST"])
def handle_webhook():
    raw_body  = request.get_data()  # raw bytes — before JSON parsing
    signature = request.headers.get("X-Signature", "")

    if not cl.verify_webhook(raw_body, signature):
        log.warning("CryptoLink: invalid webhook signature")
        abort(401)

    event    = request.get_json(force=True)
    order_id = event.get("merchantOrderID")  # your orderId from payment creation
    status   = event.get("status")

    if order_id:
        order = get_order(order_id)
        if order:
            if status == "success" and order["status"] != "completed":
                fulfill_order(order_id)
                update_order(order_id, {"status": "completed"})
            elif status == "inProgress":
                update_order(order_id, {"status": "payment_processing"})
            elif status == "failed":
                update_order(order_id, {"status": "payment_failed"})

    return jsonify({"received": True}), 200


def get_order(oid): ...
def update_order(oid, data): ...
def fulfill_order(oid): ...

from fastapi import FastAPI, Request, HTTPException, Header
from typing import Optional
import os, json
from cryptolink import CryptoLinkClient

app = FastAPI()
cl  = CryptoLinkClient(
    base_url    = os.environ["CRYPTOLINK_BASE_URL"],
    merchant_id = os.environ["CRYPTOLINK_MERCHANT_ID"],
    api_token   = os.environ["CRYPTOLINK_API_TOKEN"],
    hmac_secret = os.environ["CRYPTOLINK_HMAC_SECRET"],
)

@app.post("/webhooks/cryptolink")
async def handle_webhook(
    request: Request,
    x_signature: Optional[str] = Header(None)
):
    raw_body = await request.body()
    if not x_signature or not cl.verify_webhook(raw_body, x_signature):
        raise HTTPException(status_code=401, detail="Invalid signature")
    event = json.loads(raw_body)
    if event.get("status") == "success":
        await fulfill_order_async(event.get("merchantOrderID"))
    return {"received": True}

wp-content/plugins/cryptolink-woocommerce/
├── cryptolink-woocommerce.php   # Plugin bootstrap
└── includes/
    ├── class-cryptolink-gateway.php
    └── class-cryptolink-webhook.php

<?php
/**
 * Plugin Name: CryptoLink Payment Gateway
 * Description: Accept cryptocurrency via your self-hosted CryptoLink gateway.
 * Version:     1.0.0
 */
if (!defined('ABSPATH')) exit;

add_action('plugins_loaded', function() {
    if (!class_exists('WC_Payment_Gateway')) return;
    require_once __DIR__ . '/includes/class-cryptolink-gateway.php';
    require_once __DIR__ . '/includes/class-cryptolink-webhook.php';
    add_filter('woocommerce_payment_gateways', function($g) {
        $g[] = 'WC_CryptoLink_Gateway'; return $g;
    });
    add_action('woocommerce_api_cryptolink_webhook', ['WC_CryptoLink_Webhook', 'handle']);
});

<?php
class WC_CryptoLink_Gateway extends WC_Payment_Gateway {

    public function __construct() {
        $this->id                 = 'cryptolink';
        $this->method_title       = 'CryptoLink';
        $this->method_description = 'Accept crypto payments via your self-hosted CryptoLink gateway.';
        $this->supports           = ['products'];
        $this->init_form_fields();
        $this->init_settings();
        $this->title       = $this->get_option('title');
        $this->description = $this->get_option('description');
        add_action('woocommerce_update_options_payment_gateways_' . $this->id,
            [$this, 'process_admin_options']);
    }

    public function init_form_fields() {
        $this->form_fields = [
            'enabled'     => ['title' => 'Enable', 'type' => 'checkbox', 'default' => 'yes'],
            'title'       => ['title' => 'Title', 'type' => 'text', 'default' => 'Cryptocurrency'],
            'description' => ['title' => 'Description', 'type' => 'textarea',
                              'default' => 'Pay with BTC, ETH, USDT, and more.'],
            'base_url'    => ['title' => 'CryptoLink URL', 'type' => 'text'],
            'merchant_id' => ['title' => 'Merchant UUID', 'type' => 'text',
                              'description' => 'Found in Dashboard → Settings'],
            'api_token'   => ['title' => 'API Token', 'type' => 'password'],
            'hmac_secret' => ['title' => 'HMAC Secret', 'type' => 'password',
                              'description' => 'Set in Dashboard → Settings → Webhook'],
            'fiat_currency' => ['title' => 'Invoice Currency', 'type' => 'select',
                             'options' => ['USD' => 'USD', 'EUR' => 'EUR'],
                             'description' => 'Must match WooCommerce store currency'],
        ];
    }

    public function process_payment($order_id) {
        $order       = wc_get_order($order_id);
        $base_url    = $this->get_option('base_url');
        $merchant_id = $this->get_option('merchant_id');
        $currency    = $this->get_option('fiat_currency', 'USD'); // USD or EUR

        $payment_uuid = wp_generate_uuid4(); // unique per payment for idempotency
        $url = "{$base_url}/api/merchant/v1/merchant/{$merchant_id}/payment";

        $response = wp_remote_post($url, [
            'headers' => [
                'X-CRYPTOLINK-TOKEN' => $this->get_option('api_token'),
                'Content-Type'       => 'application/json',
            ],
            'body'    => json_encode([
                'id'          => $payment_uuid,
                'currency'    => $currency,
                'price'       => (float) $order->get_total(),
                'orderId'     => (string) $order_id,
                'description' => 'WooCommerce Order #' . $order_id,
                'redirectUrl' => $this->get_return_url($order),
            ]),
            'timeout' => 15,
        ]);

        if (is_wp_error($response)) {
            wc_add_notice('Payment error: ' . $response->get_error_message(), 'error');
            return;
        }

        $body = json_decode(wp_remote_retrieve_body($response), true);
        $code = wp_remote_retrieve_response_code($response);

        if ($code !== 201 || empty($body['paymentURL'])) {
            wc_add_notice('Payment gateway error. Please try again.', 'error');
            return;
        }

        $order->update_status('pending', 'Awaiting CryptoLink payment.');
        $order->update_meta_data('_cryptolink_payment_id', $body['id']);
        $order->save();

        return ['result' => 'success', 'redirect' => $body['paymentURL']];
    }
}

<?php
class WC_CryptoLink_Webhook {
    public static function handle() {
        $gateway     = new WC_CryptoLink_Gateway();
        $hmac_secret = $gateway->get_option('hmac_secret');
        $raw_body    = file_get_contents('php://input');
        $signature   = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
        $expected    = base64_encode(hash_hmac('sha512', $raw_body, $hmac_secret, true));

        if (!hash_equals($expected, $signature)) {
            status_header(401); exit('Invalid signature');
        }

        $event = json_decode($raw_body, true);
        $order = wc_get_order(intval($event['merchantOrderID'] ?? 0)); // your orderId
        if (!$order) { status_header(404); exit('Order not found'); }

        switch ($event['status']) {
            case 'success':
                if (!$order->is_paid()) {
                    $order->payment_complete($event['id']);
                    $order->add_order_note('CryptoLink: confirmed. Crypto: ' . $event['cryptoAmount'] . ' ' . $event['cryptoCurrency']);
                }
                break;
            case 'inProgress':
                $order->update_status('on-hold', 'CryptoLink: awaiting confirmation.');
                break;
            case 'failed':
                $order->update_status('failed', 'CryptoLink: payment failed.');
                break;
            case 'expired':
                $order->update_status('cancelled', 'CryptoLink: expired.');
                break;
        }

        status_header(200); exit(json_encode(['received' => true]));
    }
}

# Update system
sudo apt update && sudo apt upgrade -y

# Install PostgreSQL
sudo apt install -y postgresql postgresql-contrib

# Install Nginx
sudo apt install -y nginx

# Install Go 1.21+
wget https://go.dev/dl/go1.22.0.linux-amd64.tar.gz
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.22.0.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
source ~/.bashrc
go version  # verify

# Install Node.js 20 LTS (for building frontend only)
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# Create dedicated user (no login shell)
sudo useradd -r -s /sbin/nologin cryptolink

# Create directory structure
sudo mkdir -p /opt/cryptolink/{bin,config,logs}
sudo chown -R cryptolink:cryptolink /opt/cryptolink

cd /opt/cryptolink
git clone https://your-repo-url/Cryptolink.git src
cd src

sudo -u postgres psql <<EOF
CREATE DATABASE cryptolink_db;
CREATE USER cryptolink_user WITH ENCRYPTED PASSWORD 'your_strong_password_here';
GRANT ALL PRIVILEGES ON DATABASE cryptolink_db TO cryptolink_user;
EOF

oxygen:
  postgres:
    data_source: "postgres://cryptolink_user:[email protected]:5432/cryptolink_db?sslmode=disable&pool_max_conns=32"
    migrate_on_start: false  # run manually for first setup

  server:
    port: 3000
    cors:
      allow_origins:
        - https://yourdomain.com

  processing:
    webhook_base_path: https://yourdomain.com
    payment_frontend_base_path: https://yourdomain.com

  watcher:
    block_scan_depth: 50    # how many recent blocks to scan
    max_concurrency: 4      # parallel blockchain RPC calls
    enabled: true

  auth:
    email:
      enabled: true
      user_email: [email protected]

providers:
  trongrid:
    api_key: "your_trongrid_api_key"  # free at trongrid.io

cd /opt/cryptolink/src

# Run migrations once manually
DB_MIGRATE_ON_START=true /opt/cryptolink/bin/cryptolink serve-web \
  --config=/opt/cryptolink/config/cryptolink.yml &
sleep 5 && kill %1

# After successful migration, set migrate: false in cryptolink.yml

cd /opt/cryptolink/src

# Build merchant SPA (note VITE_ROOTPATH — it's required for the /merchants/ route)
cd ui-dashboard && npm install
VITE_ROOTPATH=/merchants/ npx vite build               # outputs ./dist  (merchant panel)

# Build admin SPA (separate Vite config, super-admin only)
npx vite build --config vite.admin.config.ts            # outputs ./dist-admin
cd ..

# Build payment SPA (customer-facing checkout)
cd ui-payment && npm install && npx vite build && cd ..

# Now build the Go binary (embeds the freshly built dist/ for the merchant SPA)
go build \
  -ldflags "-w -s -X 'main.gitVersion=v1.0.0' -X 'main.gitCommit=stable' -X 'main.embedFrontend=1'" \
  -o /opt/cryptolink/bin/cryptolink .

# Deploy static assets to your web root
sudo mkdir -p /var/www/cryptolink/{merchants,admin,p}
sudo cp -r ui-dashboard/dist/*       /var/www/cryptolink/merchants/
sudo cp -r ui-dashboard/dist-admin/* /var/www/cryptolink/admin/
# Admin SPA's nginx fallback is admin.html — make a copy as index.html too
sudo cp /var/www/cryptolink/admin/admin.html /var/www/cryptolink/admin/index.html
sudo cp -r ui-payment/dist/*          /var/www/cryptolink/p/

server {
    listen 443 ssl http2;
    server_name pay.yourdomain.com;

    ssl_certificate     /etc/letsencrypt/live/pay.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pay.yourdomain.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;

    root /var/www/cryptolink;

    # Merchant SPA
    location /merchants/ {
        try_files $uri $uri/ /merchants/index.html;
    }
    # Admin SPA (super-admin only — restrict by IP/auth at the proxy if desired)
    location /admin/ {
        try_files $uri $uri/ /admin/admin.html;
    }
    # Customer-facing payment page
    location /p/ {
        try_files $uri $uri/ /p/index.html;
    }
    # Legacy /dashboard/* URLs 301-redirect to /merchants/*
    location /dashboard/ {
        return 301 /merchants/$1$is_args$args;
    }

    # API — proxy to Go backend
    location /api/ {
        proxy_pass         http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 30s;
    }

    # Static assets
    location ~* \.(js|css|png|jpg|svg|ico|woff2?)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

server {
    listen 80;
    server_name pay.yourdomain.com;
    return 301 https://$host$request_uri;
}

sudo ln -s /etc/nginx/sites-available/cryptolink /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d pay.yourdomain.com
# Certbot will auto-renew. Test renewal:
sudo certbot renew --dry-run

[Unit]
Description=CryptoLink Payment Gateway
After=network.target postgresql.service
Requires=postgresql.service

[Service]
Type=simple
User=cryptolink
Group=cryptolink
WorkingDirectory=/opt/cryptolink
Environment=DB_MIGRATE_ON_START=false
ExecStart=/opt/cryptolink/bin/cryptolink serve-web \
  --config=/opt/cryptolink/config/cryptolink.yml
Restart=always
RestartSec=5
StandardOutput=append:/opt/cryptolink/logs/web.log
StandardError=append:/opt/cryptolink/logs/web.log

# Security hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ReadWritePaths=/opt/cryptolink/logs

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable cryptolink
sudo systemctl start cryptolink
sudo systemctl status cryptolink

# Tail logs
sudo tail -f /opt/cryptolink/logs/web.log

sudo ufw allow 22/tcp    # SSH
sudo ufw allow 80/tcp    # HTTP (for ACME challenges)
sudo ufw allow 443/tcp   # HTTPS
# Block direct access to the Go backend (only Nginx should access it)
sudo ufw deny 8080/tcp
sudo ufw enable