Oxin Pay provides a REST API for creating invoices, managing balances, and receiving webhook notifications. All authenticated endpoints require HMAC-SHA256 signing.
Requests to /v1/* endpoints require a signature in the X-Signature header. Compute it as HMAC-SHA256(secret_key, method + path + timestamp + body_json).
// Example: Create invoice
const ts = Date.now().toString();
const body = JSON.stringify({ amount: "10.00", currency: "USDT", chain: "BSC" });
const sig = hmacSha256(apiSecret, "POST" + "/v1/invoices" + ts + body);
fetch("https://pay.oxinchain.io/v1/invoices", {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-API-Key": apiKey,
"X-Timestamp": ts,
"X-Signature": sig,
},
body,
});All API requests must be signed with HMAC-SHA256 using your API secret key.
/web/v1/auth/loginMerchant login with email + password/web/v1/auth/signupCreate merchant account/web/v1/auth/verify-emailVerify email address with tokenCreate and manage payment invoices. Each invoice generates a unique deposit address.
/v1/invoicesCreate a new payment invoice/v1/invoices/:idGet invoice details/v1/invoicesList invoices with filters/web/v1/invoices/public/:publicIdPublic checkout data (no auth)Hosted checkout page and real-time payment status updates via Server-Sent Events.
/checkout/:invoiceIdHosted checkout page/web/v1/checkout/:publicId/eventsSSE stream for live updatesQuery your available balances and initiate withdrawals to configured addresses.
/v1/balancesGet balance per token/chain/v1/withdrawalsCreate withdrawal request/v1/withdrawalsList withdrawal historyReceive real-time notifications when payment status changes. Verified with HMAC-SHA256.
/v1/webhooksRegister webhook endpoint/v1/webhooksList webhook endpoints/v1/webhooks/:idRemove webhook endpointManage API keys for programmatic access. Keys can be scoped and revoked at any time.
/web/v1/api-keysCreate new API key/web/v1/api-keysList API keys/web/v1/api-keys/:idRevoke API keyWhen a payment event occurs, Oxin Pay POSTs a JSON payload to your registered endpoint. Verify authenticity using the X-Oxinpay-Signature header.
{
"event": "invoice.completed",
"timestamp": "2025-01-01T12:00:00Z",
"data": {
"invoice_id": "inv_abc123",
"public_id": "pub_xyz789",
"status": "completed",
"amount": "10.000000",
"currency": "USDT",
"chain": "BSC",
"tx_hash": "0xabc...",
"confirmations": 12,
"paid_at": "2025-01-01T12:00:05Z"
}
}