AvaSettle API

{timestamp}.{nonce}.{METHOD}.{path with query}.{raw body}

<?php
function avasettle(string $method, string $path, ?array $body = null): array
{
    $base   = 'https://pay.avasettle.com';
    $key    = getenv('AVASETTLE_KEY');      // pk_...
    $secret = getenv('AVASETTLE_SECRET');   // sk_...
    $raw    = $body === null ? '' : json_encode($body, JSON_UNESCAPED_SLASHES);
    $ts     = (string) time();
    $nonce  = bin2hex(random_bytes(12));
    $sig    = hash_hmac('sha256', "$ts.$nonce.$method.$path.$raw", $secret);

    $ch = curl_init($base . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POSTFIELDS     => $body === null ? null : $raw,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            "X-AVS-Key: $key",
            "X-AVS-Timestamp: $ts",
            "X-AVS-Nonce: $nonce",
            "X-AVS-Signature: $sig",
        ],
    ]);
    $res = json_decode((string) curl_exec($ch), true);
    curl_close($ch);
    return $res;
}

import crypto from 'node:crypto';

export async function avasettle(method, path, body) {
  const raw = body === undefined ? '' : JSON.stringify(body);
  const ts = Math.floor(Date.now() / 1000).toString();
  const nonce = crypto.randomBytes(12).toString('hex');
  const sig = crypto.createHmac('sha256', process.env.AVASETTLE_SECRET)
    .update(`${ts}.${nonce}.${method}.${path}.${raw}`).digest('hex');

  const res = await fetch('https://pay.avasettle.com' + path, {
    method,
    body: body === undefined ? undefined : raw,
    headers: {
      'content-type': 'application/json',
      'x-avs-key': process.env.AVASETTLE_KEY,
      'x-avs-timestamp': ts,
      'x-avs-nonce': nonce,
      'x-avs-signature': sig,
    },
  });
  return res.json();
}

import hashlib, hmac, json, os, secrets, time, urllib.request

def avasettle(method, path, body=None):
    raw = '' if body is None else json.dumps(body, separators=(',', ':'))
    ts, nonce = str(int(time.time())), secrets.token_hex(12)
    sig = hmac.new(os.environ['AVASETTLE_SECRET'].encode(),
                   f'{ts}.{nonce}.{method}.{path}.{raw}'.encode(), hashlib.sha256).hexdigest()
    req = urllib.request.Request('https://pay.avasettle.com' + path, method=method,
                                 data=None if body is None else raw.encode(), headers={
        'Content-Type': 'application/json', 'X-AVS-Key': os.environ['AVASETTLE_KEY'],
        'X-AVS-Timestamp': ts, 'X-AVS-Nonce': nonce, 'X-AVS-Signature': sig})
    with urllib.request.urlopen(req) as r:
        return json.load(r)

KEY=pk_your_key; SECRET=sk_your_secret
BODY='{"order_id":"1001","amount":"49.90","currency":"USD"}'
TS=$(date +%s); NONCE=$(openssl rand -hex 12)
SIG=$(printf '%s' "$TS.$NONCE.POST./v1/invoices.$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | sed 's/^.* //')

curl -s https://pay.avasettle.com/v1/invoices \
  -H "Content-Type: application/json" -H "X-AVS-Key: $KEY" \
  -H "X-AVS-Timestamp: $TS" -H "X-AVS-Nonce: $NONCE" -H "X-AVS-Signature: $SIG" \
  -d "$BODY"

{
  "order_id": "1001",
  "amount": "49.90",
  "currency": "USD",
  "description": "Order #1001 at Example Store",
  "success_url": "https://store.example/checkout/thanks?order=1001",
  "cancel_url": "https://store.example/cart",
  "expires_in_minutes": 60,
  "metadata": { "customer": 42 }
}

{
  "invoice": {
    "id": "inv_3f0c1b8e2a9d4c7f8e1a2b3c4d5e6f70",
    "url": "https://pay.avasettle.com/i/inv_3f0c1b8e2a9d4c7f8e1a2b3c4d5e6f70",
    "order_id": "1001",
    "amount": "49.90",
    "currency": "USD",
    "description": "Order #1001 at Example Store",
    "status": "open",
    "success_url": "https://store.example/checkout/thanks?order=1001",
    "cancel_url": "https://store.example/cart",
    "metadata": { "customer": 42 },
    "created_at": "2026-10-08T09:00:00.000Z",
    "expires_at": "2026-10-08T10:00:00.000Z",
    "payment": null,
    "payments": []
  }
}

{"options":{"USDT":{"name":"Tether","networks":[{"code":"TRON","label":"TRON (TRC20)","token":true},{"code":"BSC","label":"BNB Smart Chain (BEP20)","token":true}]},"BTC":{"name":"Bitcoin","networks":[{"code":"BTC","label":"Bitcoin","token":false}]}}}

{"order_id":"1001","amount":"49.90","currency":"USD","coin":"USDT","network":"TRON"}

{
  "id": "pay_6c2f9a1e0b7d4e3f8a9b0c1d",
  "order_id": "1001",
  "status": "paid",
  "coin": "USDT",
  "network": "TRON",
  "network_label": "TRON (TRC20)",
  "address": "TQ5n8kWmRbV3yLx2Jd9HfPc7Gs4Ae6Tu1Z",
  "memo": null,
  "amount": "49.90",
  "received": "49.90",
  "remaining": "0",
  "confirmations": 20,
  "required_confirmations": 20,
  "fiat_amount": "49.90",
  "fiat_currency": "USD",
  "paid_fiat": "49.90",
  "txid": "9f2c...e41a",
  "tx_url": "https://tronscan.org/#/transaction/9f2c...e41a",
  "qr": "TQ5n8kWmRbV3yLx2Jd9HfPc7Gs4Ae6Tu1Z",
  "metadata": { "checkout": "inv_3f0c1b8e2a9d4c7f8e1a2b3c4d5e6f70" },
  "created_at": "2026-10-08T09:01:12.000Z",
  "expires_at": "2026-10-08T09:31:12.000Z",
  "final_at": "2026-10-08T09:05:40.000Z"
}

POST /your/webhook
X-AVS-Event: payment.paid
X-AVS-Delivery: 1842
X-AVS-Timestamp: 1791450340
X-AVS-Signature: 5b1f…(64 hex chars)

{
  "event": "payment.paid",
  "created_at": "2026-10-08T09:05:40.000Z",
  "data": { "id": "pay_6c2f9a1e0b7d4e3f8a9b0c1d", "order_id": "1001", "status": "paid", "...": "the payment object" }
}

<?php
$raw = file_get_contents('php://input');
$ts  = $_SERVER['HTTP_X_AVS_TIMESTAMP'] ?? '';
$sig = $_SERVER['HTTP_X_AVS_SIGNATURE'] ?? '';
$expected = hash_hmac('sha256', $ts . '.' . $raw, getenv('AVASETTLE_WEBHOOK_SECRET'));

if (!ctype_digit($ts) || abs(time() - (int) $ts) > 300 || !hash_equals($expected, $sig)) {
    http_response_code(401);
    exit;
}
$event = json_decode($raw, true);
if ($event['event'] === 'payment.test') exit('ok');

// Never trust the body alone: read the payment again with your API key.
$payment = avasettle('GET', '/v1/payments/' . $event['data']['id'])['payment'];
if ($payment['status'] === 'paid'
    && $payment['fiat_amount'] === $order->total            // the amount you asked for
    && $payment['fiat_currency'] === $order->currency) {
    $order->markPaid($payment['txid']);
}
echo 'ok';

import crypto from 'node:crypto';

app.post('/avasettle/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
  const ts = req.get('x-avs-timestamp') ?? '';
  const expected = crypto.createHmac('sha256', process.env.AVASETTLE_WEBHOOK_SECRET)
    .update(`${ts}.${req.body}`).digest('hex');
  const sig = req.get('x-avs-signature') ?? '';
  const fresh = Math.abs(Date.now() / 1000 - Number(ts)) <= 300;
  if (!fresh || sig.length !== 64 || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return res.sendStatus(401);

  const event = JSON.parse(req.body);
  if (event.event !== 'payment.test') {
    const { payment } = await avasettle('GET', `/v1/payments/${event.data.id}`);
    if (payment.status === 'paid') await markOrderPaid(payment.order_id, payment);
  }
  res.send('ok');
});

{"error":{"code":"invalid_request","message":"Invalid or missing field: amount (decimal string)"}}