How to Integrate Replit with Coinbase API

1import os
2import hmac
3import hashlib
4import requests
5from flask import Flask, request, jsonify
6
7app = Flask(__name__)
8
9API_KEY = os.environ["COINBASE_COMMERCE_API_KEY"]
10WEBHOOK_SECRET = os.environ["COINBASE_WEBHOOK_SECRET"]
11
12BASE_URL = "https://api.commerce.coinbase.com"
13HEADERS = {
14    "X-CC-Api-Key": API_KEY,
15    "X-CC-Version": "2018-03-22",
16    "Content-Type": "application/json"
17}
18
19
20@app.route("/create-charge", methods=["POST"])
21def create_charge():
22    """Create a Coinbase Commerce charge and return the hosted payment URL."""
23    data = request.json
24    name = data.get("name", "Order")
25    description = data.get("description", "")
26    amount = data.get("amount")  # e.g. "49.99"
27    currency = data.get("currency", "USD")
28    customer_id = data.get("customer_id", "")
29
30    payload = {
31        "name": name,
32        "description": description,
33        "pricing_type": "fixed_price",
34        "local_price": {"amount": amount, "currency": currency},
35        "metadata": {"customer_id": customer_id}
36    }
37
38    resp = requests.post(f"{BASE_URL}/charges", json=payload, headers=HEADERS)
39    resp.raise_for_status()
40    charge = resp.json()["data"]
41    return jsonify({
42        "charge_id": charge["id"],
43        "code": charge["code"],
44        "hosted_url": charge["hosted_url"],
45        "expires_at": charge["expires_at"]
46    })
47
48
49def verify_webhook_signature(payload_body: bytes, signature: str) -> bool:
50    """Verify Coinbase Commerce webhook HMAC-SHA256 signature."""
51    expected = hmac.new(
52        WEBHOOK_SECRET.encode("utf-8"),
53        payload_body,
54        hashlib.sha256
55    ).hexdigest()
56    return hmac.compare_digest(expected, signature)
57
58
59@app.route("/webhook", methods=["POST"])
60def webhook():
61    """Receive and process Coinbase Commerce payment events."""
62    signature = request.headers.get("X-CC-Webhook-Signature", "")
63    raw_body = request.get_data()  # raw bytes before JSON parsing
64
65    if not verify_webhook_signature(raw_body, signature):
66        return jsonify({"error": "Invalid signature"}), 400
67
68    event = request.json
69    event_type = event["event"]["type"]
70    charge_data = event["event"]["data"]
71    charge_code = charge_data.get("code")
72    customer_id = charge_data.get("metadata", {}).get("customer_id")
73
74    print(f"Commerce event: {event_type} for charge {charge_code}, customer {customer_id}")
75
76    if event_type == "charge:confirmed":
77        # Payment fully confirmed — fulfill the order
78        print(f"Payment confirmed for customer {customer_id}. Fulfilling order.")
79        # TODO: update database, provision access, send confirmation email
80    elif event_type == "charge:failed":
81        print(f"Payment failed for charge {charge_code}")
82        # TODO: notify customer
83
84    return jsonify({"received": True}), 200
85
86
87if __name__ == "__main__":
88    app.run(host="0.0.0.0", port=3000, debug=False)

1const express = require('express');
2const axios = require('axios');
3const crypto = require('crypto');
4
5const app = express();
6
7const API_KEY = process.env.COINBASE_COMMERCE_API_KEY;
8const WEBHOOK_SECRET = process.env.COINBASE_WEBHOOK_SECRET;
9const BASE_URL = 'https://api.commerce.coinbase.com';
10
11const HEADERS = {
12  'X-CC-Api-Key': API_KEY,
13  'X-CC-Version': '2018-03-22',
14  'Content-Type': 'application/json'
15};
16
17// Parse JSON for all routes except /webhook
18app.use((req, res, next) => {
19  if (req.path === '/webhook') return next();
20  express.json()(req, res, next);
21});
22
23// Create a Commerce charge
24app.post('/create-charge', async (req, res) => {
25  const { name, description, amount, currency = 'USD', customer_id } = req.body;
26  try {
27    const { data } = await axios.post(`${BASE_URL}/charges`, {
28      name,
29      description,
30      pricing_type: 'fixed_price',
31      local_price: { amount: String(amount), currency },
32      metadata: { customer_id }
33    }, { headers: HEADERS });
34    const charge = data.data;
35    res.json({
36      charge_id: charge.id,
37      code: charge.code,
38      hosted_url: charge.hosted_url,
39      expires_at: charge.expires_at
40    });
41  } catch (err) {
42    console.error('Create charge error:', err.response?.data || err.message);
43    res.status(500).json({ error: err.message });
44  }
45});
46
47// Webhook endpoint — uses raw body for signature verification
48app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
49  const signature = req.headers['x-cc-webhook-signature'] || '';
50  const rawBody = req.body; // Buffer
51
52  const expectedSig = crypto
53    .createHmac('sha256', WEBHOOK_SECRET)
54    .update(rawBody)
55    .digest('hex');
56
57  if (!crypto.timingSafeEqual(Buffer.from(expectedSig), Buffer.from(signature))) {
58    return res.status(400).json({ error: 'Invalid signature' });
59  }
60
61  const event = JSON.parse(rawBody);
62  const eventType = event.event.type;
63  const chargeData = event.event.data;
64  const customerId = chargeData.metadata?.customer_id;
65
66  console.log(`Commerce event: ${eventType} for charge ${chargeData.code}`);
67
68  if (eventType === 'charge:confirmed') {
69    console.log(`Payment confirmed for customer ${customerId}`);
70    // TODO: fulfill order, update database
71  } else if (eventType === 'charge:failed') {
72    console.log(`Payment failed for charge ${chargeData.code}`);
73  }
74
75  res.json({ received: true });
76});
77
78app.listen(3000, '0.0.0.0', () => {
79  console.log('Coinbase Commerce server running on port 3000');
80});