Migrate · from NowPayments ▓ ~45-MINUTE TARGET Shape-compatible REST

NowPayments out.
OrbChain in.

NowPayments IPN signatures use HMAC-SHA512 — the same algorithm we use, against a different key. Most merchants move the invoice surface in under an hour. Concrete mapping below.

Start migrating → Read the comparison

Same HMAC · Different keys

§ Part I / IV · Endpoint mapping

Direct mappings.

Custody differences
handled at your accounting layer

TopicNowPaymentsOrbChainDelta

INVCreate invoicePOST api.nowpayments.io/v1/invoiceRENAME

INV↳POST orbchain.io/v1/payment/invoiceORB

PAYCreate paymentPOST api.nowpayments.io/v1/paymentMAP

PAY↳POST orbchain.io/v1/payment/white-labelORB

STAStatic addressNot first-partyNEW

STA↳POST orbchain.io/v1/payment/static-addressORB

POMass payoutsPOST api.nowpayments.io/v1/payoutRENAME

PO↳POST orbchain.io/v1/payout/batchORB

STTPayment statusGET api.nowpayments.io/v1/payment/:idRESHAPE

STT↳GET orbchain.io/v1/payment/:track_idORB

§ Part II / IV · Field mapping

Invoice body.

1:1 for most keys
One addition: accepted_coins

TopicNowPaymentsOrbChainNotes

AMTprice_amountamountRENAME

CURprice_currencycurrencyRENAME

PAYpay_currency (single, required)pay_currency (single) OR accepted_coins (multiple)MULTI-OK

ORDorder_idorder_idSAME

DSCorder_descriptiondescriptionRENAME

CBipn_callback_urlcallback_urlRENAME

SUCsuccess_urlreturn_urlRENAME

CNCcancel_urlcancel_urlSAME

§ Part III / IV · Side-by-side

Before. After.

Drop-in
Rename, ship

POST invoice · before + afterdiff · 200 OK

// NowPayments — before
curl https://api.nowpayments.io/v1/invoice \
  -H "x-api-key: NP_…" \
  -H "Content-Type: application/json" \
  -d '{
    "price_amount":       50,
    "price_currency":     "USD",
    "pay_currency":       "usdt",
    "order_id":           "order_7f92a1",
    "ipn_callback_url":   "https://shop.example/ipn",
    "success_url":        "https://shop.example/ok"
  }'

// OrbChain — after
curl https://orbchain.io/v1/payment/invoice \
  -H "merchant_api_key: mk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "amount":           50,
    "currency":         "USD",
    "accepted_coins":   ["USDT_TRC20", "USDC_TRC20"],
    "order_id":         "order_7f92a1",
    "callback_url":     "https://shop.example/webhooks/orb",
    "return_url":       "https://shop.example/ok"
  }'

§ Part IV / IV · HMAC verifier

Same algorithm.
New secret.

NowPayments + OrbChain
both HMAC-SHA512

node HMAC verifier · diffrename the secret · you're done

// NowPayments — HMAC-SHA512 with `NP_IPN_SECRET`, header `x-nowpayments-sig`
function verifyNP(rawBody, header) {
  const expected = crypto.createHmac("sha512", process.env.NP_IPN_SECRET)
    .update(rawBody).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(header, "hex")
  );
}

// OrbChain — HMAC-SHA512 with `ORB_WEBHOOK_SECRET`, header `HMAC`
function verifyOrb(rawBody, header) {
  const expected = crypto.createHmac("sha512", process.env.ORB_WEBHOOK_SECRET)
    .update(rawBody).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(header, "hex")
  );
}

// Upgrade: dedupe with OrbChain's deterministic event_id
//         — NowPayments uses a random UUID that requires your own dedup table.
if (seenEventIds.has(payload.event_id)) return res.sendStatus(200);

One renamed secret.
One migrated stack.

Most stacks move the invoice surface in under an hour. No custody transfer required — both sides non-live until you flip.

Create account → Read the full spec