PayCoinPro API

https://paycoinpro.com/docs
Admin
PayCoinPro API allows applications to easily integrate cryptocurrency payments, create invoices,...
Tokens:9,010
Snippets:46
Trust Score:2.3
Update:8 months ago
Show doc for...
Tokens:
Raw
### Webhook Signature Format Example

Source: https://paycoinpro.com/docs/index

This example shows the format of the `X-Webhook-Signature` header used by PayCoinPro for security. It includes a Unix timestamp and an HMAC-SHA256 signature of the payload.

```bash
X-Webhook-Signature: t=1735302052,v1=a8a66f7c3b6654eba9935e198ab3e3d288874afcaca0fd721e6581f331799e26
```

--------------------------------

### Example Payment Response (JSON)

Source: https://paycoinpro.com/docs/index

An example JSON response representing a completed payment transaction. It includes details such as transaction ID, amounts, currency, status, payment address, order ID, customer email, and relevant timestamps. This structure is typically returned after a successful payment or invoice creation.

```json
{
  "id": "clx1abc123def456",
  "amount": 99.99,
  "currency": "USD",
  "amountCrypto": 0.0025,
  "amountReceived": 0,
  "status": "PENDING",
  "paymentAddress": "0x1234...",
  "orderId": "ORD-12345",
  "customerEmail": "customer@example.com",
  "expiresAt": "2024-01-15T12:00:00.000Z",
  "paidAt": null,
  "createdAt": "2024-01-15T11:00:00.000Z",
  "updatedAt": "2024-01-15T11:00:00.000Z",
  "paymentUrl": "https://pay.paycoinpro.com/pay/clx1abc123"
}
```

--------------------------------

### GET /api/v1/assets

Source: https://paycoinpro.com/docs/index

Retrieve the list of available cryptocurrencies and their supported networks. This is useful for displaying currency options or validating asset/network combinations.

```APIDOC
## GET /api/v1/assets

### Description
Retrieve the list of available cryptocurrencies and their supported networks. Use this endpoint to display currency options to your users or to validate asset/network combinations before creating invoices or deposit addresses.

### Method
GET

### Endpoint
/api/v1/assets

### Parameters
#### Query Parameters
None

### Request Example
```curl
curl -X GET "https://paycoinpro.com/api/v1/assets" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Response
#### Success Response (200)
An empty JSON object is returned in the example, but this endpoint is expected to return a list of available assets and their network details.

#### Response Example
```json
{}
```
```

--------------------------------

### GET /api/v1/deposits

Source: https://paycoinpro.com/docs/index

List all deposits received across your deposit addresses.

```APIDOC
## GET /api/v1/deposits

### Description
List all deposits received across your deposit addresses.

### Method
GET

### Endpoint
/api/v1/deposits

### Parameters
#### Query Parameters
- **limit** (number) - Optional - Results per page (1-100, default: 50)
- **offset** (number) - Optional - Number of results to skip (default: 0)
- **depositAddressId** (string) - Optional - Filter by deposit address ID
- **status** (string) - Optional - Filter by deposit status

### Request Example
```curl
curl -X GET "https://paycoinpro.com/api/v1/deposits" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Response
#### Success Response (200)
An empty JSON object is returned in the example, but this endpoint is expected to return a list of deposits.

#### Response Example
```json
{}
```
```

--------------------------------

### GET /api/v1/deposit-addresses

Source: https://paycoinpro.com/docs/index

List all your deposit addresses with optional filtering and pagination.

```APIDOC
## GET /api/v1/deposit-addresses

### Description
List all your deposit addresses with optional filtering and pagination.

### Method
GET

### Endpoint
/api/v1/deposit-addresses

### Parameters
#### Query Parameters
- **limit** (number) - Optional - Results per page (1-100, default: 50)
- **offset** (number) - Optional - Number of results to skip (default: 0)
- **externalUserId** (string) - Optional - Filter by external user identifier
- **status** (string) - Optional - Filter by address status (ACTIVE, INACTIVE, SUSPENDED)

### Request Example
```curl
curl -X GET "https://paycoinpro.com/api/v1/deposit-addresses" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Response
#### Success Response (200)
An empty JSON object is returned in the example, but this endpoint is expected to return a list of deposit addresses.

#### Response Example
```json
{}
```
```

--------------------------------

### GET /api/v1/invoices - List Invoices

Source: https://paycoinpro.com/docs/index

List all invoices with optional filtering and pagination.

```APIDOC
## GET /api/v1/invoices

### Description
List all invoices with optional filtering and pagination.

### Method
GET

### Endpoint
/api/v1/invoices

### Parameters
#### Query Parameters
- **status** (string) - Optional - Filter by invoice status
- **limit** (number) - Optional - Results per page (1-100, default: 20)
- **offset** (number) - Optional - Number of results to skip (default: 0)

### Request Example
```bash
curl -X GET "https://paycoinpro.com/api/v1/invoices" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Response
#### Success Response (200)
- **(object)** - An empty object is returned if no invoices are found or if the response is empty.

#### Response Example
```json
{}
```
```

--------------------------------

### Example API Error Response

Source: https://paycoinpro.com/docs/index

This JSON object demonstrates the standard format for error responses from the Paycoinpro API. It includes a human-readable error message and a machine-readable error code.

```json
{
  "error": "Invalid or missing API key",
  "code": "UNAUTHORIZED"
}
```

--------------------------------

### Example Deposit Address Response (JSON)

Source: https://paycoinpro.com/docs/index

This JSON object represents a deposit address generated by the PayCoinPro API. It includes a unique ID, the actual deposit address, its status, the associated external user ID (if provided), total received funds, payment count, and expiration and creation timestamps. This response is returned after successfully requesting a deposit address.

```json
{
  "id": "depaddr_cly1234567890",
  "address": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "status": "ACTIVE",
  "externalUserId": "user_123",
  "totalReceived": "0",
  "paymentCount": 0,
  "expiresAt": "2026-01-01T10:30:00.000Z",
  "createdAt": "2025-12-22T10:30:00.000Z"
}
```

--------------------------------

### GET /api/v1/invoices/{id} - Get Invoice

Source: https://paycoinpro.com/docs/index

Retrieve details of a specific invoice by ID.

```APIDOC
## GET /api/v1/invoices/{id}

### Description
Retrieve details of a specific invoice by ID.

### Method
GET

### Endpoint
/api/v1/invoices/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier of the invoice

### Request Example
```bash
curl -X GET "https://paycoinpro.com/api/v1/invoices/{id}" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Response
#### Success Response (200)
- **(object)** - Returns the details of the specified invoice. The structure is the same as the response for creating an invoice.

#### Response Example
```json
{
  "id": "clx1abc123def456",
  "amount": 99.99,
  "currency": "USD",
  "status": "PENDING",
  "orderId": "ORD-12345",
  "customerEmail": "customer@example.com",
  "title": "Order #12345",
  "description": "Payment for premium subscription",
  "successUrl": "https://yoursite.com/success",
  "cancelUrl": "https://yoursite.com/cancel",
  "expiresAt": "2024-01-15T12:00:00.000Z",
  "paymentUrl": "https://pay.paycoinpro.com/pay/clx1abc123",
  "createdAt": "2024-01-15T11:00:00.000Z",
  "asset": "USDT",
  "network": "bsc",
  "depositAddress": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "amountCrypto": 99.85
}
```
```

--------------------------------

### Deposit Webhook Payload Example

Source: https://paycoinpro.com/docs/index

This JSON object represents the payload for a deposit event webhook. It contains information about a confirmed deposit, including the deposit address, sender address, transaction hash, and amounts.

```json
{
  "event": "deposit",
  "status": "CONFIRMED",
  "depositAddress": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "senderAddress": "0x9876543210fedcba9876543210fedcba98765432",
  "txHash": "0x1234567890abcdef1234567890abcdef...",
  "amount": 100.50,
  "amountFiat": 100.50,
  "cryptoSymbol": "USDT",
  "network": "BSC",
  "networkName": "BNB Smart Chain",
  "timestamp": "2024-01-15T12:31:00.000Z"
}
```

--------------------------------

### POST /api/v1/deposit-addresses

Source: https://paycoinpro.com/docs/index

Get or create a persistent deposit address for a specific cryptocurrency on a network. Supports unique addresses per external user and configurable expiry.

```APIDOC
## POST /api/v1/deposit-addresses

### Description
Get or create a persistent deposit address for a specific cryptocurrency on a network. Addresses can be unique per external user and have configurable expiry. Funds sent to these addresses are automatically credited to your merchant balance.

### Method
POST

### Endpoint
/api/v1/deposit-addresses

### Parameters
#### Request Body
- **asset** (string) - Required - Asset symbol (e.g., usdt, btc, eth)
- **network** (string) - Required - Network code (e.g., ethereum, bsc, polygon, tron)
- **externalUserId** (string) - Optional - External user identifier for tracking deposits per customer. Max 255 characters.
- **expiryDays** (integer) - Optional - Number of days until address expires (1-365). Default: 30. Set to null for never expires.

### Request Example
```curl
curl -X POST "https://paycoinpro.com/api/v1/deposit-addresses" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"asset":"usdt","network":"bsc","externalUserId":"user_123","expiryDays":30}'
```

### Response
#### Success Response (200)
- **id** (string) - Unique identifier for the deposit address.
- **address** (string) - The generated deposit address.
- **status** (string) - The current status of the address (e.g., ACTIVE).
- **externalUserId** (string) - The external user ID associated with the address, if provided.
- **totalReceived** (string) - The total amount received at this address.
- **paymentCount** (integer) - The number of payments received at this address.
- **expiresAt** (string) - The timestamp when the address will expire.
- **createdAt** (string) - The timestamp when the address was created.

#### Response Example
```json
{
  "id": "depaddr_cly1234567890",
  "address": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "status": "ACTIVE",
  "externalUserId": "user_123",
  "totalReceived": "0",
  "paymentCount": 0,
  "expiresAt": "2026-01-01T10:30:00.000Z",
  "createdAt": "2025-12-22T10:30:00.000Z"
}
```
```

--------------------------------

### Invoice Webhook Payload Example

Source: https://paycoinpro.com/docs/index

This JSON object represents the payload for an invoice event webhook. It includes details about the invoice, such as its ID, order ID, status, payment amounts, and transaction information.

```json
{
  "event": "invoice",
  "invoiceId": "inv_abc123",
  "orderId": "ORDER-001",
  "status": "PAID",
  "depositAddress": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "senderAddress": "0x9876543210fedcba9876543210fedcba98765432",
  "txHash": "0x1234567890abcdef...",
  "amountReceived": 100.50,
  "amountExpected": 100.00,
  "cryptoSymbol": "USDT",
  "network": "BSC",
  "networkName": "BNB Smart Chain",
  "amountFiat": 100.00,
  "fiatCurrency": "USD",
  "timestamp": "2024-01-15T12:30:00.000Z"
}
```

--------------------------------

### Get a Specific PayCoinPro Invoice using cURL

Source: https://paycoinpro.com/docs/index

This cURL command demonstrates how to fetch the details of a specific invoice using its ID. The invoice ID is appended to the API endpoint. Authentication is required via the Authorization header.

```curl
curl -X GET "https://paycoinpro.com/api/v1/invoices/{id}" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

--------------------------------

### List Available Assets (API)

Source: https://paycoinpro.com/docs/index

Retrieves a list of supported cryptocurrencies and their networks. Useful for displaying currency options or validating asset/network pairs before creating invoices or deposit addresses. Requires an API key for authorization.

```curl
curl -X GET "https://paycoinpro.com/api/v1/assets" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

```javascript
fetch("https://paycoinpro.com/api/v1/assets", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_API_KEY"
  }
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));
```

```python
import requests

headers = {
    "Authorization": "Bearer YOUR_API_KEY"
}

response = requests.get("https://paycoinpro.com/api/v1/assets", headers=headers)
print(response.json())
```

--------------------------------

### Create a PayCoinPro Invoice using cURL

Source: https://paycoinpro.com/docs/index

This cURL command demonstrates how to create a new payment invoice using the PayCoinPro API. It includes parameters for amount, currency, order ID, customer email, expiration, and optional details like metadata, callback URL, and allowed assets. The response contains invoice details including a payment URL.

```curl
curl -X POST "https://paycoinpro.com/api/v1/invoices" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"amount":99.99,"currency":"USD","orderId":"ORD-12345","customerEmail":"customer@example.com","expiresIn":60,"metadata":{"customField":"value"},"title":"Order #12345","description":"Payment for premium subscription","callbackUrl":"https://yoursite.com/api/webhook","successUrl":"https://yoursite.com/success","cancelUrl":"https://yoursite.com/cancel","underpaymentTolerance":0.1,"allowedAssets":["usdt","btc","eth"],"asset":"eth","network":"ethereum","isTest":false}'
```

--------------------------------

### POST /api/v1/invoices - Create Invoice

Source: https://paycoinpro.com/docs/index

Create a new payment invoice. Returns a payment URL that you can redirect your customer to.

```APIDOC
## POST /api/v1/invoices

### Description
Create a new payment invoice. Returns a payment URL that you can redirect your customer to.

### Method
POST

### Endpoint
/api/v1/invoices

### Parameters
#### Request Body
- **amount** (number) - Required - Invoice amount in fiat currency
- **currency** (string) - Optional - Fiat currency code (optional, defaults to USD if not provided)
- **orderId** (string) - Optional - Your internal order reference
- **customerEmail** (string) - Optional - Customer email for notifications
- **expiresIn** (object) - Optional - Expiry time in minutes: 30 (30min), 60 (1h), or 120 (2h). If not provided, uses merchant default.
- **metadata** (object) - Optional - Custom key-value metadata (max 20 keys, values must be primitives)
- **title** (string) - Optional - Invoice title displayed on payment page
- **description** (string) - Optional - Invoice description displayed on payment page
- **callbackUrl** (string) - Optional - Webhook URL for payment notifications (overrides merchant default). Must be a public http/https URL.
- **successUrl** (string) - Optional - Redirect URL after successful payment (overrides merchant default). Must be a public http/https URL.
- **cancelUrl** (string) - Optional - Redirect URL if customer cancels (overrides merchant default). Must be a public http/https URL.
- **underpaymentTolerance** (number) - Optional - Percentage below expected amount to accept as paid (0.1-1%). Default is 0.1%. If not provided, uses merchant default.
- **allowedAssets** (array) - Optional - List of allowed currency symbols. If not provided, uses merchant default or all currencies.
- **asset** (string) - Optional - Asset symbol (e.g., eth, btc, usdt). If provided with network, invoice will be auto-finalized with a deposit address.
- **network** (string) - Optional - Network code (e.g., ethereum, polygon, bsc). Required if asset is provided.
- **isTest** (boolean) - Optional - Create a test invoice that can be "paid" via simulate button. Test invoices do not require real funds.

### Request Example
```json
{
  "amount": 99.99,
  "currency": "USD",
  "orderId": "ORD-12345",
  "customerEmail": "customer@example.com",
  "expiresIn": 60,
  "metadata": {"customField": "value"},
  "title": "Order #12345",
  "description": "Payment for premium subscription",
  "callbackUrl": "https://yoursite.com/api/webhook",
  "successUrl": "https://yoursite.com/success",
  "cancelUrl": "https://yoursite.com/cancel",
  "underpaymentTolerance": 0.1,
  "allowedAssets": ["usdt","btc","eth"],
  "asset": "eth",
  "network": "ethereum",
  "isTest": false
}
```

### Response
#### Success Response (200)
- **id** (string) - Unique identifier for the invoice
- **amount** (number) - The amount of the invoice
- **currency** (string) - The fiat currency of the invoice
- **status** (string) - The current status of the invoice (e.g., PENDING, PAID, EXPIRED)
- **orderId** (string) - Your internal order reference
- **customerEmail** (string) - Customer email for notifications
- **title** (string) - Invoice title displayed on payment page
- **description** (string) - Invoice description displayed on payment page
- **successUrl** (string) - Redirect URL after successful payment
- **cancelUrl** (string) - Redirect URL if customer cancels
- **expiresAt** (string) - The timestamp when the invoice expires
- **paymentUrl** (string) - The URL to redirect the customer to for payment
- **createdAt** (string) - The timestamp when the invoice was created
- **asset** (string) - The cryptocurrency asset used for payment
- **network** (string) - The network used for the cryptocurrency asset
- **depositAddress** (string) - The deposit address for the cryptocurrency payment
- **amountCrypto** (number) - The equivalent amount in cryptocurrency

#### Response Example
```json
{
  "id": "clx1abc123def456",
  "amount": 99.99,
  "currency": "USD",
  "status": "PENDING",
  "orderId": "ORD-12345",
  "customerEmail": "customer@example.com",
  "title": "Order #12345",
  "description": "Payment for premium subscription",
  "successUrl": "https://yoursite.com/success",
  "cancelUrl": "https://yoursite.com/cancel",
  "expiresAt": "2024-01-15T12:00:00.000Z",
  "paymentUrl": "https://pay.paycoinpro.com/pay/clx1abc123",
  "createdAt": "2024-01-15T11:00:00.000Z",
  "asset": "USDT",
  "network": "bsc",
  "depositAddress": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "amountCrypto": 99.85
}
```
```

--------------------------------

### List Deposits (API)

Source: https://paycoinpro.com/docs/index

Fetches a list of all received deposits across the merchant's deposit addresses. Allows filtering by `depositAddressId` and `status`, and supports pagination via `limit` and `offset`. Requires an API key.

```curl
curl -X GET "https://paycoinpro.com/api/v1/deposits" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

```javascript
fetch("https://paycoinpro.com/api/v1/deposits", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_API_KEY"
  }
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));
```

```python
import requests

headers = {
    "Authorization": "Bearer YOUR_API_KEY"
}

response = requests.get("https://paycoinpro.com/api/v1/deposits", headers=headers)
print(response.json())
```

--------------------------------

### List PayCoinPro Invoices using cURL

Source: https://paycoinpro.com/docs/index

This cURL command shows how to retrieve a list of invoices from the PayCoinPro API. It includes the necessary Authorization header. Optional query parameters can be added to filter by status or paginate results.

```curl
curl -X GET "https://paycoinpro.com/api/v1/invoices" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

--------------------------------

### Verify Webhook Signature in Node.js

Source: https://paycoinpro.com/docs/index

This JavaScript code snippet demonstrates how to verify PayCoinPro webhook signatures using Node.js. It includes functions to parse the signature header, verify the signature with replay protection, and process the webhook event.

```javascript
const crypto = require('crypto');
const express = require('express');

// Parse signature header: t=timestamp,v1=signature
function parseSignatureHeader(header) {
  const parts = header.split(',');
  let timestamp = 0, signature = '';

  for (const part of parts) {
    const [key, value] = part.split('=');
    if (key === 't') timestamp = parseInt(value, 10);
    if (key === 'v1') signature = value;
  }

  return { timestamp, signature };
}

// Verify webhook with replay protection
function verifyWebhook(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  const { timestamp, signature } = parseSignatureHeader(signatureHeader);

  // Replay protection - reject webhooks older than 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (now - timestamp > toleranceSeconds) {
    throw new Error(`Webhook too old: ${now - timestamp}s`);
  }

  // Reconstruct signed payload and verify
  const signedPayload = `${timestamp}.${rawBody}`;
  const expected = crypto.createHmac('sha256', secret).update(signedPayload).digest('hex');

  // Timing-safe comparison
  const sigBuffer = Buffer.from(signature, 'hex');
  const expBuffer = Buffer.from(expected, 'hex');

  if (sigBuffer.length !== expBuffer.length ||
      !crypto.timingSafeEqual(sigBuffer, expBuffer)) {
    throw new Error('Invalid webhook signature');
  }

  return JSON.parse(rawBody);
}

// IMPORTANT: Use raw body middleware for webhooks
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  const signatureHeader = req.headers['x-webhook-signature'];

  try {
    const event = verifyWebhook(rawBody, signatureHeader, process.env.WEBHOOK_SECRET);

    // Process the webhook based on event type
    if (event.event === 'invoice') {
      console.log(`Invoice ${event.invoiceId} status: ${event.status}`);
    } else if (event.event === 'deposit') {
      console.log(`Deposit: ${event.amount} ${event.cryptoSymbol}`);
    }

    res.status(200).json({ received: true });
  } catch (error) {
    console.error('Webhook verification failed:', error.message);
    res.status(401).json({ error: 'Invalid signature' });
  }
});

```

--------------------------------

### Create Deposit Address (API)

Source: https://paycoinpro.com/docs/index

Generates or retrieves a persistent deposit address for a specified cryptocurrency and network. Supports unique addresses per customer using `externalUserId` and configurable expiry. Funds sent to this address are automatically credited to the merchant balance. Requires an API key.

```curl
curl -X POST "https://paycoinpro.com/api/v1/deposit-addresses" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"asset":"usdt","network":"bsc","externalUserId":"user_123","expiryDays":30}'
```

```javascript
const payload = {
  "asset": "usdt",
  "network": "bsc",
  "externalUserId": "user_123",
  "expiryDays": 30
};

fetch("https://paycoinpro.com/api/v1/deposit-addresses", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify(payload)
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));
```

```python
import requests
import json

headers = {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
}

payload = {
    "asset": "usdt",
    "network": "bsc",
    "externalUserId": "user_123",
    "expiryDays": 30
}

response = requests.post("https://paycoinpro.com/api/v1/deposit-addresses", headers=headers, data=json.dumps(payload))
print(response.json())
```

--------------------------------

### List Deposit Addresses (API)

Source: https://paycoinpro.com/docs/index

Retrieves a list of all deposit addresses associated with the merchant account. Supports filtering by `externalUserId` and `status`, as well as pagination using `limit` and `offset`. Requires an API key.

```curl
curl -X GET "https://paycoinpro.com/api/v1/deposit-addresses" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

```javascript
fetch("https://paycoinpro.com/api/v1/deposit-addresses", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_API_KEY"
  }
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));
```

```python
import requests

headers = {
    "Authorization": "Bearer YOUR_API_KEY"
}

response = requests.get("https://paycoinpro.com/api/v1/deposit-addresses", headers=headers)
print(response.json())
```

--------------------------------

### Deposit Webhook

Source: https://paycoinpro.com/docs/index

This webhook is triggered when funds are received and confirmed at your merchant deposit addresses.

```APIDOC
## Deposit Webhook

### Description
Sent when funds are received at your merchant deposit addresses (created via the Deposit Addresses API). These are sent to your default webhook URL configured in merchant settings.

### Event Type
`deposit`

### Payload Structure
```json
{
  "event": "deposit",
  "status": "CONFIRMED",
  "depositAddress": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "senderAddress": "0x9876543210fedcba9876543210fedcba98765432",
  "txHash": "0x1234567890abcdef1234567890abcdef...",
  "amount": 100.50,
  "amountFiat": 100.50,
  "cryptoSymbol": "USDT",
  "network": "BSC",
  "networkName": "BNB Smart Chain",
  "timestamp": "2024-01-15T12:31:00.000Z"
}
```

### Deposit Status Values
- **CONFIRMED**: Deposit received and confirmed at a merchant deposit address
```

--------------------------------

### Authenticate API Requests with Bearer Token

Source: https://paycoinpro.com/docs/index

All API requests to PayCoinPro require authentication. This is done by including your API key in the 'Authorization' header as a Bearer token. Ensure your API key is kept secure and never exposed in client-side code.

```bash
Authorization: Bearer ck_your_api_key_here
```

--------------------------------

### Webhook Signature Verification

Source: https://paycoinpro.com/docs/index

Secure your webhook endpoints by verifying the signature of incoming requests to ensure they originate from PayCoinPro.

```APIDOC
## Webhook Signature Verification

### Description
PayCoinPro uses webhook signatures for security. The signature is sent in the `X-Webhook-Signature` header. You must verify this signature using the raw request body and your webhook secret.

### Signature Header Format
`X-Webhook-Signature: t=<timestamp>,v1=<signature>`

- **t**: Unix timestamp (seconds) when the webhook was sent.
- **v1**: HMAC-SHA256 signature of `{timestamp}.{raw_payload}`.

**Important**: Use the raw request body for verification, not the parsed JSON object. Webhooks older than 5 minutes are rejected (replay protection).

### Example Implementation (Node.js)
```javascript
const crypto = require('crypto');
const express = require('express');

// Parse signature header: t=timestamp,v1=signature
function parseSignatureHeader(header) {
  const parts = header.split(',');
  let timestamp = 0, signature = '';

  for (const part of parts) {
    const [key, value] = part.split('=');
    if (key === 't') timestamp = parseInt(value, 10);
    if (key === 'v1') signature = value;
  }

  return { timestamp, signature };
}

// Verify webhook with replay protection
function verifyWebhook(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  const { timestamp, signature } = parseSignatureHeader(signatureHeader);

  // Replay protection - reject webhooks older than 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (now - timestamp > toleranceSeconds) {
    throw new Error(`Webhook too old: ${now - timestamp}s`);
  }

  // Reconstruct signed payload and verify
  const signedPayload = `${timestamp}.${rawBody}`;
  const expected = crypto.createHmac('sha256', secret).update(signedPayload).digest('hex');

  // Timing-safe comparison
  const sigBuffer = Buffer.from(signature, 'hex');
  const expBuffer = Buffer.from(expected, 'hex');

  if (sigBuffer.length !== expBuffer.length ||
      !crypto.timingSafeEqual(sigBuffer, expBuffer)) {
    throw new Error('Invalid webhook signature');
  }

  return JSON.parse(rawBody);
}

// IMPORTANT: Use raw body middleware for webhooks
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  const signatureHeader = req.headers['x-webhook-signature'];

  try {
    const event = verifyWebhook(rawBody, signatureHeader, process.env.WEBHOOK_SECRET);

    // Process the webhook based on event type
    if (event.event === 'invoice') {
      console.log(`Invoice ${event.invoiceId} status: ${event.status}`);
    } else if (event.event === 'deposit') {
      console.log(`Deposit: ${event.amount} ${event.cryptoSymbol}`);
    }

    res.status(200).json({ received: true });
  } catch (error) {
    console.error('Webhook verification failed:', error.message);
    res.status(401).json({ error: 'Invalid signature' });
  }
});
```
```

--------------------------------

### Invoice Webhook

Source: https://paycoinpro.com/docs/index

This webhook is triggered when an invoice's status changes. It provides details about the invoice, payment, and transaction.

```APIDOC
## Invoice Webhook

### Description
Sent when an invoice's status changes. It provides details about the invoice, payment, and transaction.

### Event Type
`invoice`

### Payload Structure
```json
{
  "event": "invoice",
  "invoiceId": "inv_abc123",
  "orderId": "ORDER-001",
  "status": "PAID",
  "depositAddress": "0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00",
  "senderAddress": "0x9876543210fedcba9876543210fedcba98765432",
  "txHash": "0x1234567890abcdef...",
  "amountReceived": 100.50,
  "amountExpected": 100.00,
  "cryptoSymbol": "USDT",
  "network": "BSC",
  "networkName": "BNB Smart Chain",
  "amountFiat": 100.00,
  "fiatCurrency": "USD",
  "timestamp": "2024-01-15T12:30:00.000Z"
}
```

### Invoice Status Values
- **PAID**: Payment received and confirmed (97-105% of expected amount)
- **UNDERPAID**: Payment below expected amount (within tolerance)
- **OVERPAID**: Payment exceeds expected amount (>105%)
- **PARTIAL**: Partial payment received, awaiting more
- **EXPIRED**: Invoice expired without payment
```
Tokens:
Raw