A backend that creates a Secure Payment link in response to your app’s events — a customer hitting checkout, an invoice being approved, a subscription renewing. The customer opens the link, pays from any chain/token in any supported wallet, and your webhook fires when the payment confirms.Audience: developers integrating Request Network into an e-commerce app, marketplace, SaaS, or accounting product.Apps used:
Pass redirectUrl (and optionally redirectLabel) when creating the payment link. After a successful payment, the success screen renders a button that opens your URL — the payer clicks it to return to your site. There is no auto-redirect; the button is an explicit user action.
redirectUrl must be http(s). Other schemes (javascript:, data:, etc.) and HTML/script payload characters are rejected with 400 redirectUrl must be a safe http(s) URL with no script/HTML payload.
redirectLabel is 1–255 chars and rejects HTML control characters (<, >, &, ", ', `).
redirectLabel cannot be set without redirectUrl — the API rejects with 400 redirectLabel cannot be provided without redirectUrl.
If you don’t pass redirectLabel, the button reads “Go Back and Close”.
The same fields are accepted on POST /v2/secure-payments/payouts for hosted payout links.
Tron is a drop-in replacement for any EVM destination as long as you submit a single recipient per call. The shape is identical; only the destinationId and addresses change format.
Submitting multiple requests[] items where any destination is on Tron returns a 400 with Batch payments are not supported for TRON networks. Please submit individual payment requests. See Batch payouts for the EVM-only batch flow.
To pay someone (a contractor, vendor, refund recipient) via a hosted link they open and sign, use POST /v2/secure-payments/payouts. Same shape, single recipient, EVM or Tron.
Your webhook endpoint receives signed POSTs as the payment lifecycle progresses. Verify the HMAC-SHA256 signature against your webhook secret before parsing the body.
import { createHmac, timingSafeEqual } from "node:crypto";import express from "express";const app = express();// Capture raw body for signature verificationapp.use( "/webhook", express.raw({ type: "application/json" }), (req, res) => { const signature = req.headers["x-request-network-signature"] as string; const expected = createHmac("sha256", process.env.WEBHOOK_SECRET!) .update(req.body) .digest("hex"); const sigBuf = Buffer.from(signature, "hex"); const expBuf = Buffer.from(expected, "hex"); const ok = sigBuf.length === expBuf.length && timingSafeEqual(sigBuf, expBuf); if (!ok) return res.status(401).send("invalid signature"); const event = JSON.parse(req.body.toString("utf8")); if (event.event === "payment.confirmed") { // Mark the order paid in your DB, fire fulfillment, etc. } res.status(200).send("ok"); },);