Accept Bitcoin without giving up custody.

<a href="https://satscollect.com/pay/PRODUCT_UUID">Pay with Bitcoin</a>

<?php
$payload = [
    'amount' => 49.90,
    'currency' => 'usd',
    'return_url' => 'https://shop.example.com/orders/ORD-1042/paid',
];

// URL-safe base64 without padding.
$encoded = rtrim(strtr(base64_encode(json_encode($payload)), '+/', '-_'), '=');
$signature = hash_hmac('sha256', $encoded, $_ENV['SATSCOLLECT_SECRET']);

$checkoutUrl = 'https://satscollect.com/pay/PRODUCT_UUID?'.http_build_query([
    'payload' => $encoded,
    'signature' => $signature,
]);

header('Location: '.$checkoutUrl);

import crypto from "node:crypto";

const payload = {
  amount: 49.90,
  currency: "usd",
  return_url: "https://shop.example.com/orders/ORD-1042/paid",
};

const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
const signature = crypto
  .createHmac("sha256", process.env.SATSCOLLECT_SECRET)
  .update(encoded)
  .digest("hex");

const url = new URL("https://satscollect.com/pay/PRODUCT_UUID");
url.searchParams.set("payload", encoded);
url.searchParams.set("signature", signature);

response.redirect(url.toString());

<?php
$paymentId = $_GET['payment_id'] ?? '';
$token = $_GET['token'] ?? '';
$expected = hash_hmac('sha256', $paymentId, $_ENV['SATSCOLLECT_SECRET']);

if (! hash_equals($expected, $token)) {
    http_response_code(401);
    exit('Invalid SatsCollect token');
}

// Also match payment_id to the expected order, then fulfill idempotently.

import crypto from "node:crypto";

const paymentId = String(request.query.payment_id ?? "");
const token = String(request.query.token ?? "");
const expected = crypto
  .createHmac("sha256", process.env.SATSCOLLECT_SECRET)
  .update(paymentId)
  .digest("hex");

const valid = token.length === expected.length &&
  crypto.timingSafeEqual(Buffer.from(token), Buffer.from(expected));

if (!valid) return response.status(401).send("Invalid SatsCollect token");

{
  "event": "payment.confirmed",
  "payment_request": {
    "id": 1842,
    "uuid": "2dc80cf4-8859-42e7-920b-d51bda70cd02",
    "vendor_id": 12,
    "product_id": 48,
    "product_uuid": "4ffbe5fb-0912-4a8c-a485-40b095f7a3e4",
    "address": "bc1q…",
    "expected_amount": "0.00072410",
    "received_amount": "0.00072410",
    "confirmed": true,
    "paid_at": "2026-09-16T11:42:18+00:00",
    "currency": "usd",
    "fiat_amount": "49.90",
    "payload": "eyJhbW91bnQi…",
    "return_url": "https://shop.example.com/orders/ORD-1042/paid"
  }
}

<?php
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SATSCOLLECT_SIGNATURE'] ?? '';
$expected = hash_hmac('sha256', $rawBody, $_ENV['SATSCOLLECT_SECRET']);

if (! hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid webhook signature');
}

$event = json_decode($rawBody, true, flags: JSON_THROW_ON_ERROR);
if ($event['event'] === 'payment.confirmed') {
    // Fulfill once, keyed by payment_request.id or .uuid.
}

http_response_code(200);

app.post("/webhooks/satscollect", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.get("X-SatsCollect-Signature") ?? "";
  const expected = crypto
    .createHmac("sha256", process.env.SATSCOLLECT_SECRET)
    .update(req.body)
    .digest("hex");

  const valid = signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  if (!valid) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf8"));
  // Fulfill idempotently using event.payment_request.id or .uuid.
  return res.sendStatus(200);
});