Payment Proof developers

API version 1.0. Server-to-server bearer keys and signed webhook events are included in your existing Payment Proof plan. No mandatory add-on fee.

Starter 9 USDC: 50 payment requests / 50 invoices, 1 key / 1 destination. Business 19: 200 / 200, 3 / 3. Pro 29: unlimited monthly requests and invoices, 10 / 10, subject to resource fair use and rate limits. All plans cover 30 days. The seven-day trial includes 12 / 12 and 1 / 1. Existing wallet and email limits apply.

Create keys and destinations in the account Integrations tab. Keys and signing secrets are shown once. Payment Proof keys are separate from Processing API keys and credits. Receiving wallets must first be verified in the dashboard.

OpenAPI 1.0 reference · Complete API, events and integration recipes · Python HMAC verification · Node HMAC verification · Merchant dashboard

Quickstart · Python durable receiver · Node durable receiver

Implementation reference: deployment and real payment/email end-to-end delivery have not been verified.

Create a payment request

curl https://www.skavio.eu/proof/v1/requests \
 -H 'Authorization: Bearer YOUR_PAYMENT_PROOF_KEY' \
 -H 'Content-Type: application/json' \
 -H 'Idempotency-Key: merchant-order-20261011-0001' \
 -d '{"wallet_id":"YOUR_VERIFIED_WALLET_ID","amount_usdc":"29.00","description":"Order 0001"}'

All mutations require a stable Idempotency-Key. Replay with the same payload returns the original response. Conflicting reuse returns 409. Invoices default to no email; sending requires explicit user approval. Only verified blockchain settlement emits payment.confirmed.

Webhook verification

Headers: X-Skavio-Timestamp (Unix seconds), X-Skavio-Signature: v1=<hex>, X-Skavio-Event-Id, X-Skavio-Delivery-Id and X-Skavio-Key-Version. Verify HMAC SHA256 over the literal timestamp, a dot, and untouched body bytes. Compare in constant time, reject timestamps older/newer than five minutes, match the signed event ID and deduplicate it durably. Delivery is at least once; automatic retries use the same event/delivery IDs and up to five attempts. Do not mark orders paid from checkout success.

HTTPS public hosts on port 443 only. No query credentials, redirects, proxies or private destinations. Generic Make.com, n8n and WooCommerce recipes use your own verified receiver; no official native plugins are claimed.