XthonPay REST API

X-API-Key:   xpay_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-Timestamp: 1711324800
X-Signature: <hex hmac-sha256>

msg = f"{timestamp}\n{method}\n{path}\n".encode() + body
sig = hmac_sha256(secret, msg).hex()

import hmac, hashlib, time, json, requests

KEY_ID = "xpay_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
SECRET = "your-secret-shown-once"
BASE   = "https://xthonpay.com"

def signed(method, path, payload=None):
    body = b"" if payload is None else json.dumps(payload, separators=(",",":")).encode()
    ts   = str(int(time.time()))
    msg  = f"{ts}\n{method}\n{path}\n".encode() + body
    sig  = hmac.new(SECRET.encode(), msg, hashlib.sha256).hexdigest()
    headers = {
        "X-API-Key":    KEY_ID,
        "X-Timestamp":  ts,
        "X-Signature":  sig,
        "Content-Type": "application/json",
    }
    return requests.request(method, BASE + path, data=body, headers=headers)

print(signed("GET", "/v1/balance").json())

{
  "error": {
    "code":    "ERROR_CODE",
    "message": "human-readable reason"
  }
}

{
  "balance":         "14500.50000000",
  "frozen_balance":  "0",
  "total_deposited": "18000.00000000",
  "total_withdrawn": "3499.50000000",
  "webhook_secret":  "64-char-hex-used-to-verify-webhooks"
}

{
  "address": "0x7a3B4c2d9E1f...8a6F42d",
  "network": "BSC (BEP20)",
  "token":   "USDT"
}

{
  "amount":       "100.00",
  "external_id":  "ORDER-9921",
  "description":  "Pro subscription (1 month)",
  "callback_url": "https://yourapp.com/webhooks/xthonpay",
  "success_url":  "https://yourapp.com/orders/9921",
  "metadata":     { "user_id": 4821 },
  "expires_in":   1800
}

{
  "status": "success",
  "data": {
    "invoice_id":      42,
    "deposit_address": "0x9Cb0...bd74",
    "amount":          "100.00",
    "currency":        "USDT",
    "status":          "pending",
    "expires_at":      "2026-04-15T10:30:00"
  }
}

{
  "status": "success",
  "data": {
    "invoice_id":      42,
    "external_id":     "ORDER-9921",
    "deposit_address": "0x9Cb0...bd74",
    "amount":          "100.00",
    "amount_received": "100.00",
    "currency":        "USDT",
    "status":          "paid",
    "tx_hash":         "0xabc...123",
    "from_address":    "0x71C7...62b",
    "paid_at":         "2026-04-15T10:12:00",
    "expires_at":      "2026-04-15T10:30:00"
  }
}

{
  "amount":     "500.00",
  "to_address": "0x71C765...9A62b",
  "currency":   "USDT"
}

{
  "ok":            true,
  "withdrawal_id": 87,
  "status":        "approved",
  "currency":      "USDT",
  "amount":        "500.00000000",
  "fee":           "0.00000000",
  "net_amount":    "500.00000000",
  "to_address":    "0x71C7...62b"
}

Content-Type:          application/json
User-Agent:            XthonPay-Webhook/1.0
X-XthonPay-Timestamp:  1711324800
X-XthonPay-Delivery:   b4f2a1c8-1234-4abc-9d5f-ff8a1b2c3d4e
X-XthonPay-Signature:  <hex hmac-sha256>

msg = f"{timestamp}.{delivery_id}.".encode() + raw_body
sig = hmac_sha256(webhook_secret, msg).hex()

import hmac, hashlib, time

def verify(req, secret: str, tolerance: int = 300) -> bool:
    ts  = req.headers["X-XthonPay-Timestamp"]
    did = req.headers["X-XthonPay-Delivery"]
    sig = req.headers["X-XthonPay-Signature"]
    if abs(time.time() - int(ts)) > tolerance:
        return False
    msg = f"{ts}.{did}.".encode() + req.body
    expected = hmac.new(secret.encode(), msg, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

{
  "event": "invoice.paid",
  "data": {
    "invoice_id":      42,
    "external_id":     "ORDER-9921",
    "amount":          "100.00",
    "amount_received": "100.00",
    "currency":        "USDT",
    "status":          "paid",
    "tx_hash":         "0xabc...123",
    "from_address":    "0x71C7...62b",
    "paid_at":         "2026-04-15T10:12:00"
  }
}