[ Developers ]

A Stripe-compatible API
for USDC payments.

Every Ripey store comes with a REST API and signed webhooks. If you’ve built on Stripe, you already know the objects: products, prices, checkout sessions, payment links, customers, subscriptions and events.

Base URL https://pay.ripey.app/v1 · Auth header x-api-key · JSON bodies · Live in test mode

01 / Keys

Get your API key

Open your store, then Open dashboard → Developers → API keys. Test keys start with sk_test_ and move simulated USDC only. Keep secret keys on your server.

02 / Checkout

Create a checkout

Create a session on your server and redirect the buyer. Ripey hosts the payment page.

Checkout session
curl https://pay.ripey.app/v1/checkout/sessions \
  -H "x-api-key: $RIPEY_SECRET_KEY" \
  -H "content-type: application/json" \
  -d '{
    "mode": "payment",
    "line_items": [{ "price": "price_z_...", "quantity": 1 }],
    "success_url": "https://yoursite.com/thanks",
    "client_reference_id": "order_123"
  }'
# → { "id": "cs_z_...", "url": "https://pay.ripey.app/c/..." }  Redirect the buyer to url.
Products, prices and payment links
# A product and its price (amounts in cents: 2900 = 29.00 USDC)
curl https://pay.ripey.app/v1/products -H "x-api-key: $RIPEY_SECRET_KEY" -H "content-type: application/json" \
  -d '{ "name": "Inbox Triage" }'

curl https://pay.ripey.app/v1/prices -H "x-api-key: $RIPEY_SECRET_KEY" -H "content-type: application/json" \
  -d '{ "product": "prod_z_...", "unit_amount": 2900, "currency": "usdc" }'

# Or a reusable payment link
curl https://pay.ripey.app/v1/payment_links -H "x-api-key: $RIPEY_SECRET_KEY" -H "content-type: application/json" \
  -d '{ "line_items": [{ "price": "price_z_...", "quantity": 1 }] }'

03 / Webhooks

Fulfil orders from webhooks

The success redirect only means the buyer came back. Grant access when a signed checkout.session.completed event arrives. Signatures use HMAC-SHA256 over <timestamp>.<raw body>, in the same format as Stripe’s.

Add an endpoint
curl https://pay.ripey.app/v1/webhook_endpoints \
  -H "x-api-key: $RIPEY_SECRET_KEY" \
  -H "content-type: application/json" \
  -d '{
    "url": "https://yoursite.com/webhooks/ripey",
    "enabled_events": ["checkout.session.completed", "invoice.paid"]
  }'
# → { "id": "we_z_...", "secret": "whsec_..." }  The secret is shown once: store it.
Verify an event
// Node.js: verify the signature on the raw request body, then trust the event.
import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyRipeyEvent(rawBody, header, secret, toleranceSec = 300) {
  // header: "t=1700000000,v1=5f2b..."  (sent as Zoneless-Signature)
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) throw new Error("Stale event");
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const given = Buffer.from(parts.v1 ?? "");
  if (given.length !== expected.length || !timingSafeEqual(given, Buffer.from(expected)))
    throw new Error("Bad signature");
  return JSON.parse(rawBody); // e.g. { type: "checkout.session.completed", data: { object: {...} } }
}

04 / More

Resources

No backend? Use the pay button or let your agent run the store.

/products, /prices
Products & prices
/checkout/sessions
Checkout sessions
/payment_links
Payment links
/customers
Customers
/subscriptions, /invoices
Subscriptions & invoices
/webhook_endpoints, /events
Webhook endpoints & events