Crypto payments for your Discord bot

import { ActionRowBuilder, ButtonBuilder, ButtonStyle, MessageFlags } from "discord.js";

client.on("interactionCreate", async (interaction) => {
  if (!interaction.isChatInputCommand() || interaction.commandName !== "buy") return;
  await interaction.deferReply({ flags: MessageFlags.Ephemeral });
  const res = await fetch("https://api.coinsflow.app/v1/invoices", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.COINSFLOW_API_KEY}`,
      "Idempotency-Key": interaction.id, // a retry never makes a second invoice
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      chain: "litecoin", asset: "LTC", priceAmount: "20.00",
      description: "VIP role",
      metadata: { userId: interaction.user.id, guildId: interaction.guildId, channelId: interaction.channelId },
    }),
  });
  if (!res.ok) return interaction.editReply("Payments are not available right now. Try again in a minute.");
  const invoice = await res.json();
  const pay = new ButtonBuilder().setStyle(ButtonStyle.Link).setLabel("Pay in Litecoin").setURL(invoice.paymentUrl);
  await interaction.editReply({
    content: "Your invoice for the VIP role. The page shows the address, the amount and a QR code.",
    components: [new ActionRowBuilder().addComponents(pay)],
  });
});

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.COINSFLOW_WEBHOOK_SECRET; // whsec_...
const app = express();

function verified(header, body) {
  try {
    const parts = Object.fromEntries(String(header ?? "").split(",").map((p) => p.split("=", 2)));
    const t = String(parts.t ?? "");
    if (!/^\d{1,12}$/.test(t) || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
    const given = Buffer.from(String(parts.v1 ?? ""), "hex");
    const expected = crypto.createHmac("sha256", SECRET).update(`${t}.`).update(body).digest();
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  } catch {
    return false;
  }
}

app.post("/webhooks/coinsflow", express.raw({ type: "application/json" }), async (req, res) => {
  if (!Buffer.isBuffer(req.body) || !verified(req.get("CoinsFlow-Signature"), req.body)) return res.sendStatus(400);
  const event = JSON.parse(req.body.toString("utf8"));
  if (!event.type.startsWith("invoice.")) return res.sendStatus(200);
  if (event.test && !process.env.TESTING) return res.sendStatus(200); // test events only while you test
  const { id, metadata } = event.data;
  if (!metadata?.channelId) return res.sendStatus(200); // not one of the bot's invoices
  try {
    const channel = await client.channels.fetch(metadata.channelId);
    if (event.type === "invoice.detected") {
      await channel.send(`<@${metadata.userId}> Payment seen. It counts at the first confirmation.`);
    }
    if (event.type === "invoice.paid" && !(await delivered(id))) { // your database: once per invoice
      const guild = await client.guilds.fetch(metadata.guildId);
      const member = await guild.members.fetch(metadata.userId);
      await member.roles.add(process.env.VIP_ROLE_ID);
      await markDelivered(id);
      await channel.send(`<@${metadata.userId}> Paid. Your role is on.`);
    }
    res.sendStatus(200);
  } catch {
    res.sendStatus(500); // CoinsFlow sends it again later
  }
});

app.listen(3000);