OxaPay out.
OrbChain in.

// OxaPay — before
curl https://api.oxapay.com/merchants/request \
  -H "Content-Type: application/json" \
  -d '{
    "merchant":     "sandbox",
    "amount":       50,
    "currency":     "USD",
    "orderId":      "order_7f92a1",
    "callbackUrl":  "https://shop.example/webhooks/oxa",
    "lifeTime":     60
  }'

// OrbChain — after
curl https://orbchain.io/v1/payment/invoice \
  -H "merchant_api_key: mk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "amount":          50,
    "currency":        "USD",
    "accepted_coins":  ["BTC_LN", "USDT_TRC20"],
    "order_id":        "order_7f92a1",
    "callback_url":    "https://shop.example/webhooks/orb",
    "expires_in":      3600
  }'

// OxaPay — HMAC-SHA256 over JSON body, header `HMAC`
const crypto = require("crypto");
function verifyOxa(body, header, secret) {
  const expected = crypto.createHmac("sha256", secret)
    .update(body).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(header, "hex")
  );
}

// OrbChain — HMAC-SHA512 over JSON body, header `HMAC`
function verifyOrb(body, header, secret) {
  const expected = crypto.createHmac("sha512", secret)  // only diff
    .update(body).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(header, "hex")
  );
}

// Bonus: dedupe with OrbChain's deterministic event_id
if (seenEventIds.has(payload.event_id)) return res.sendStatus(200);