A POST
callback will be sent to the specified notificationUrl
(for on-chain transactions when there are sufficient confirmations):
@Model.ExampleCallback
Never trust anything but id
, ignore the other fields completely, an attacker can spoof those, they are present only for backward compatibility reason:
- Send a
GET
request to https://btcpay.example.com/invoices/{invoiceId}
with Content-Type: application/json; Authorization: Basic YourLegacyAPIkey"
, Legacy API key can be created with Access Tokens in Store settings
- Verify that the
orderId
is from your backend, that the price
is correct and that status
is settled
- You can then ship your order