This migration guide helps you move off the operational burden of running BTCPay Server while keeping HMAC-SHA256 webhook signing, refunds, and on-demand payouts intact.

1// BTCPay Server
2const response = await fetch(
3  "https://btcpay.example.com/api/v1/stores/STORE_ID/invoices",
4  {
5    method: "POST",
6    headers: {
7      Authorization: `token ${BTCPAY_API_KEY}`,
8      "Content-Type": "application/json",
9    },
10    body: JSON.stringify({
11      amount: "49.99",
12      currency: "USD",
13      metadata: { orderId: "order_123" },
14      checkout: {
15        redirectURL: "https://yoursite.com/success",
16      },
17    }),
18  },
19);
20
21const invoice = await response.json();
22// Redirect to: invoice.checkoutLink

1// Payvra
2import Payvra from "payvra";
3
4const payvraSecretKey = process.env.PAYVRA_SECRET_KEY;
5if (!payvraSecretKey) {
6  throw new Error("Set PAYVRA_SECRET_KEY before running this example.");
7}
8
9const payvra = new Payvra(payvraSecretKey);
10
11const payment = await payvra.payments.create({
12  amount: "49.99",
13  currency: "USDC",
14  metadata: { orderId: "order_123" },
15});
16
17// Redirect to: payment.checkoutUrl

1// BTCPay Server webhook handler
2app.post("/webhooks/btcpay", (req, res) => {
3  const signature = req.headers["btcpay-sig"];
4  const expected =
5    "sha256=" +
6    crypto
7      .createHmac("sha256", WEBHOOK_SECRET)
8      .update(req.rawBody)
9      .digest("hex");
10
11  if (signature !== expected) {
12    return res.status(401).send("Invalid");
13  }
14
15  const { type, invoiceId, metadata } = req.body;
16  if (type === "InvoiceSettled") {
17    // Mark order paid, metadata.orderId
18  }
19
20  res.sendStatus(200);
21});

1// Payvra webhook handler
2app.post("/webhooks", (req, res) => {
3  const signature = req.headers["webhook-signature"];
4  const timestamp = req.headers["webhook-timestamp"];
5  const webhookId = req.headers["webhook-id"];
6
7  const signedContent = `${webhookId}.${timestamp}.${req.rawBody}`;
8  const expected = crypto
9    .createHmac("sha256", WEBHOOK_SECRET)
10    .update(signedContent)
11    .digest("base64");
12
13  if (signature !== `v1,${expected}`) {
14    return res.status(401).send("Invalid");
15  }
16
17  const { type, data } = req.body;
18  if (type === "payment.completed") {
19    // Mark order paid, data.metadata.orderId
20  }
21
22  res.sendStatus(200);
23});