Quickstart
Create a payment link from your own code, send your customer to it, and get told on your server when they pay.
Before you start
- Finish onboarding. Payments have nowhere to go until a wallet is connected.
- Copy your secret key from Dashboard > Developer Tools. It starts with
brykto_live_sk_.
Keep the secret key server-side
Anyone holding it can create payments in your name. Never ship it to a browser or commit it to a repository.
Step 1 - Create a payment link
POST /v1/payment-links returns a request_id. Everything else you need is built from it.
import requests
BASE = "https://bryktopay.com"
API_KEY = "brykto_live_sk_your_key_here"
response = requests.post(
f"{BASE}/v1/payment-links",
headers={"X-API-Key": API_KEY},
json={
"amount": 49.90,
"currency": "USD",
"description": "Order 1042",
"order_id": "1042",
},
timeout=10,
)
response.raise_for_status()
payment = response.json()
pay_url = f"{BASE}/pay/{payment['request_id']}"
print(pay_url)const BASE = "https://bryktopay.com";
const API_KEY = "brykto_live_sk_your_key_here";
const response = await fetch(`${BASE}/v1/payment-links`, {
method: "POST",
headers: {
"X-API-Key": API_KEY,
"Content-Type": "application/json",
},
body: JSON.stringify({
amount: 49.90,
currency: "USD",
description: "Order 1042",
order_id: "1042",
}),
});
if (!response.ok) throw new Error(await response.text());
const payment = await response.json();
const payUrl = `${BASE}/pay/${payment.request_id}`;
console.log(payUrl);curl -X POST https://bryktopay.com/v1/payment-links \
-H "X-API-Key: brykto_live_sk_your_key_here" \
-H "Content-Type: application/json" \
-d '{
"amount": 49.90,
"currency": "USD",
"description": "Order 1042",
"order_id": "1042"
}'Response
{
"request_id": "3f9a1c2e-7b4d-4f81-9c22-1a5e6d8b0f33",
"amount": 49.9,
"currency": "USD",
"receive_asset": "USDC",
"rail": "stellar",
"description": "Order 1042",
"destination_tag": null,
"stellar_memo": "a1b2c3d4e5f6",
"expires_at": "2026-08-17T12:30:00+00:00",
"created_at": "2026-08-17T12:00:00+00:00"
}There is no pay_url field
Build the payment page address yourself: https://bryktopay.com/pay/{request_id}.
Step 2 - Send your customer there
Redirect them, email them the link, or render it as a button. The page handles the rest: a QR code on desktop, a wallet deep link on mobile, and manual details for anyone paying from an exchange.
API links expire in 30 minutes
They are meant to be created at the moment a customer is ready to pay. If yours sits in an email for an hour, create it from the dashboard instead, which gives it 7 days.
Step 3 - Receive the webhook
Set your webhook URL under Dashboard > Developer Tools, then verify every call before you act on it.
import hashlib
import hmac
import os
from flask import Flask, request, abort
app = Flask(__name__)
WEBHOOK_SECRET = os.environ["BRYKTO_WEBHOOK_SECRET"]
def verify(body: bytes, signature: str, timestamp: str) -> bool:
signed = timestamp.encode("utf-8") + b"." + body
expected = hmac.new(
WEBHOOK_SECRET.encode("utf-8"), signed, hashlib.sha256
).hexdigest()
return hmac.compare_digest(f"sha256={expected}", signature)
@app.post("/webhook/brykto")
def brykto_webhook():
body = request.get_data()
if not verify(
body,
request.headers.get("X-Brykto-Signature", ""),
request.headers.get("X-Brykto-Timestamp", ""),
):
abort(400)
event = request.get_json()
if event["event"] == "order.paid":
order_id = event["data"]["order_id"]
tx_hash = event["data"]["tx_hash"]
fulfil(order_id, tx_hash)
return "", 200import crypto from "crypto";
import express from "express";
const router = express.Router();
const SECRET = process.env.BRYKTO_WEBHOOK_SECRET;
function verify(body, signature, timestamp) {
const expected = "sha256=" + crypto
.createHmac("sha256", SECRET)
.update(Buffer.concat([Buffer.from(timestamp + "."), body]))
.digest("hex");
const a = Buffer.from(expected);
const b = Buffer.from(signature || "");
return a.length === b.length && crypto.timingSafeEqual(a, b);
}
router.post("/webhook/brykto",
express.raw({ type: "application/json" }),
(req, res) => {
const ok = verify(
req.body,
req.headers["x-brykto-signature"],
req.headers["x-brykto-timestamp"],
);
if (!ok) return res.status(400).end();
const event = JSON.parse(req.body);
if (event.event === "order.paid") {
fulfil(event.data.order_id, event.data.tx_hash);
}
res.status(200).end();
});Sign the raw body, not re-serialised JSON
If your framework parses the request and you rebuild it before hashing, the signature will never match. Take the bytes exactly as they arrived.
That is the whole integration
Create a payment, send the customer, fulfil from the webhook. There is no SDK to install and no checkout UI to build.
Next steps
- E-commerce checkout - send a customer to pay mid-session and bring them back
- Payment Links API - every request and response field
- Webhooks - full payload, retries, and the security checklist