Integrate payments.
Keep the funds.

Authorization: Bearer vlt_live_...

# Also accepted on merchant resource endpoints
X-API-Key: vlt_live_...

curl https://vulta.one/api/apikeys \
  -X POST \
  -H "Authorization: Bearer YOUR_USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "label": "production store" }'

{
  "key": "vlt_live_...",
  "api_key": {
    "id": "uuid",
    "key_prefix": "vlt_live_a1b2c3",
    "label": "production store",
    "created_at": "..."
  }
}

curl https://vulta.one/api/checkout/sessions \
  -H "Authorization: Bearer vlt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "amount_fiat": "29.00",
    "fiat_currency": "USD",
    "external_reference_id": "order_123",
    "use_all_payout_destinations": true,
    "payer_email": "customer@example.com"
  }'

{
  "id": "018f4f3e-2e8b-7a21-9f0c-0b6f56a7d3b1",
  "checkout_url": "https://vulta.one/pay/018f4f3e-2e8b-7a21-9f0c-0b6f56a7d3b1",
  "payment_request": {
    "id": "018f4f3e-2e8b-7a21-9f0c-0b6f56a7d3b1",
    "pricing_mode": "fixed_fiat",
    "amount_fiat": "29.00",
    "fiat_currency": "USD",
    "status": "OPEN",
    "expires_at": "..."
  }
}

// Browser code calls your backend, never Vulta with a secret key.
const response = await fetch('/api/store/orders/123/vulta-checkout', {
  method: 'POST'
});
if (!response.ok) throw new Error('Checkout creation failed');

const { checkout_url } = await response.json();
window.location.assign(checkout_url);

<script src="https://vulta.one/widget.js"></script>
<button type="button" data-vulta-link="PAYMENT_LINK_ID">
  Pay now
</button>

<script src="https://vulta.one/widget.js"></script>
<button type="button" onclick="openVultaCheckout()">Pay now</button>
<script>
  function openVultaCheckout() {
    Vulta.open('PAYMENT_LINK_ID', {
      onSuccess: function (event) {
        // UI signal only. Fulfill the order from the signed server webhook.
        console.log(event.paymentRequestId);
      }
    });
  }
</script>

<iframe
  src="https://pay.vulta.one/embed/link/PAYMENT_LINK_ID?parentOrigin=https%3A%2F%2Fshop.example"
  title="Secure checkout"
  width="420"
  height="680"
  style="border:0;border-radius:24px"
  sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin"
  allow="payment"
></iframe>

curl https://vulta.one/api/checkout/crypto \
  -H "Authorization: Bearer vlt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "network": "TRON",
    "asset": "USDT",
    "amount_crypto": "150.00",
    "external_reference_id": "order_456"
  }'

{
  "payment_request_id": "uuid",
  "payment_request_option_id": "uuid",
  "address": "TJRyWwFs9wTFGZg3JbrVriFbNfCug5tDeC",
  "network": "TRON",
  "asset": "USDT",
  "amount_fiat": null,
  "fiat_currency": null,
  "amount_crypto": "150.00",
  "encoded_amount": null,
  "amount_to_send": "150.00"
}

curl https://vulta.one/api/checkout/card \
  -H "Authorization: Bearer vlt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "amount_fiat": "75.00",
    "currency": "EUR",
    "external_reference_id": "order_789"
  }'

{
  "provider_url": "https://provider.example/...",
  "payment_request_id": "uuid",
  "provider": "moonpay"
}

curl https://vulta.one/api/payout-destinations \
  -H "Authorization: Bearer vlt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "network": "Polygon",
    "asset": "USDC",
    "address": "0xYourWallet",
    "entry_method": "manual",
    "label": "Store settlements"
  }'

curl https://vulta.one/api/payment-links \
  -H "Authorization: Bearer vlt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Pro plan",
    "pricing_mode": "fixed_fiat",
    "fixed_amount_fiat": "49.00",
    "fixed_amount_currency": "USD",
    "is_hybrid": true,
    "payout_destination_ids": ["POLYGON_USDC_DESTINATION_ID"],
    "allowed_embed_origins": ["https://shop.example"]
  }'

curl https://vulta.one/api/payment-requests \
  -H "Authorization: Bearer vlt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "one_off": {
      "pricing_mode": "fixed_fiat",
      "amount_fiat": "250.00",
      "fiat_currency": "USD",
      "external_reference_id": "invoice_1042",
      "use_all_payout_destinations": true
    }
  }'

curl https://vulta.one/api/settings/webhook \
  -X PUT \
  -H "Authorization: Bearer YOUR_USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "webhook_url": "https://shop.example/api/vulta/webhook",
    "webhook_secret": "replace-with-a-long-random-secret"
  }'

{
  "event_id": "9ef824be-50d4-4b75-97c0-f6bc3cc39e5f",
  "event_type": "payment.confirmed",
  "occurred_at": "2026-07-24T12:00:00Z",
  "payment_request_id": "a1b2c3d4-e5f6-...",
  "external_reference_id": "order_123",
  "amount_fiat": "29.00",
  "fiat_currency": "USD",
  "tx_hash": "0xabc123...",
  "status": "CONFIRMED",
  "merchant_id": "c3d4e5f6-..."
}

X-Vulta-Event-ID: <event_id>
X-Vulta-Timestamp: <unix-seconds>
X-Vulta-Signature-V2: <hex HMAC-SHA256(timestamp + "." + raw_body)>
X-Vulta-Signature: <legacy body-only hex HMAC>

const crypto = require('crypto');
const express = require('express');
const app = express();

function validHexDigest(value) {
  return typeof value === 'string' && /^[0-9a-f]{64}$/i.test(value);
}

function verifyVultaWebhook(rawBody, headers, secret) {
  const timestamp = headers['x-vulta-timestamp'];
  const signature = headers['x-vulta-signature-v2'];
  const eventId = headers['x-vulta-event-id'];
  const unixTime = Number(timestamp);

  if (!eventId || !Number.isFinite(unixTime)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - unixTime) > 300) return false;
  if (!validHexDigest(signature)) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(timestamp)
    .update('.')
    .update(rawBody)
    .digest();
  const provided = Buffer.from(signature, 'hex');

  return provided.length === expected.length &&
    crypto.timingSafeEqual(provided, expected);
}

app.post('/api/vulta/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verifyVultaWebhook(req.body, req.headers, process.env.VULTA_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(req.body.toString('utf8'));

  // In one DB transaction:
  // 1. INSERT event.event_id into a UNIQUE column (ignore duplicates).
  // 2. Fulfill event.external_reference_id.
  // 3. Commit.

  return res.status(204).end();
});

import hashlib
import hmac
import time

def verify_vulta_webhook(raw_body: bytes, headers, secret: str) -> bool:
    timestamp = headers.get("X-Vulta-Timestamp", "")
    signature = headers.get("X-Vulta-Signature-V2", "")
    event_id = headers.get("X-Vulta-Event-ID", "")

    try:
        if not event_id or abs(int(time.time()) - int(timestamp)) > 300:
            return False
        provided = bytes.fromhex(signature)
    except (TypeError, ValueError):
        return False

    expected = hmac.new(
        secret.encode(),
        timestamp.encode() + b"." + raw_body,
        hashlib.sha256,
    ).digest()
    return hmac.compare_digest(provided, expected)