Skip to content

Find a component

Loading the directory…

↑ ↓ to select · Enter to open · Esc to closeBrowse all →
Contributor login

OxaPay

Crypto payments for Convex. Invoices, wallets, and payouts in your Convex backend.

Upstream source
git clone https://github.com/BradPerbs/convex-oxapay.git
cd convex-oxapay

This upstream package has not been adapted or qualified for Bijection. Read the original documentation before adopting it.

Description

Crypto payments for Convex. Invoices, wallets, and payouts in your Convex backend.

Explore the package README for API concepts, configuration, and examples. Check the Bijection source for adaptation-specific setup.

Available to evaluate

Review the source and its dependencies before adopting this package. Source availability does not establish npm publication or runtime qualification.

Getting started

  1. Get the source at the revision above and read its package documentation.
  2. Check the required Bijection SDK version, dependencies, and external service credentials.
  3. Follow the package setup instructions and the guide to using components.
  4. Exercise the component in your deployment according to your project’s verification rules.

Open source

Maintained source: BradPerbs/convex-oxapay. License: See repository. Consult the repository for license terms, notices, and contributor attribution.

From the upstream publisher

An OxaPay (crypto payments) component for Convex.

Explore the demo ↗

Upstream overview

From the upstream package documentation.

A Convex Component that integrates OxaPay's crypto payment gateway for accepting Bitcoin, Ethereum, USDT, USDC, and other cryptocurrencies. It provides hosted invoices, white-label payments, static deposit addresses, and payouts with automatic status mirroring to your Convex database. The component includes webhook handling with HMAC verification and React hooks for live payment status updates.

Use cases

From the upstream package documentation.

  • E-commerce checkout: Create hosted crypto invoices with createInvoice() that redirect users to OxaPay's payment page while mirroring status updates back to your Convex database
  • Custom payment UI: Build white-label checkout flows using createWhiteLabel() to get raw payment addresses and QR codes without redirecting users off your site
  • Wallet top-ups: Generate static deposit addresses with staticAddresses.create() for users to fund their accounts or set up recurring crypto subscriptions
  • Crypto payouts: Send payments to users with payouts.create() and track confirmation status through the mirrored payout table
  • Real-time payment tracking: Use the React hooks to display live payment status updates without polling external APIs

How it works

From the upstream package documentation.

The component registers with your Convex app through defineApp() and creates mirror tables for payments, payouts, and static addresses. You instantiate the OxaPay client with your API keys and call methods like createInvoice() or createWhiteLabel() from Convex actions.

Webhook handling is configured through registerRoutes() on your HTTP router, with automatic HMAC-SHA512 verification using your API keys. When OxaPay sends status updates, the component deduplicates deliveries, updates the mirror tables, and runs your custom event handlers for specific payment states like payment.paid or payout.confirmed.

The React integration provides useQuery() access to the mirrored data for instant UI updates. Methods like payments.get() and payments.listForEntity() let you query payment status by track ID or user, while the automatic mirroring ensures your frontend stays synchronized with OxaPay's payment state without additional API calls.

Upstream package FAQ

What cryptocurrencies does the OxaPay component support?

The convex-oxapay component supports Bitcoin, Ethereum, USDT, USDC, and dozens of other cryptocurrencies across multiple blockchain networks. It accepts both fiat-priced invoices (USD, EUR) and crypto-native amounts.

How does webhook verification work with OxaPay?

The convex-oxapay component automatically handles HMAC-SHA512 webhook verification using your API key as the secret. It performs idempotent deduplication and only processes forward status transitions, so duplicate or out-of-order webhooks are safely ignored.

Can I build custom checkout UI instead of hosted pages?

Yes, the convex-oxapay component provides createWhiteLabel() for fully custom checkout experiences. This returns the crypto address, exact payment amount, and QR code data so you can build your own payment interface while still getting automatic status updates.

How do I test payments before going live?

The convex-oxapay component supports OxaPay's sandbox mode by setting OXAPAY_SANDBOX=true in your environment variables. This sends sandbox:true on all payment creation calls for testing without real cryptocurrency transactions.

What Convex functions do I need to handle payments?

The convex-oxapay component works through Convex actions for creating payments (since they call external APIs) and queries for reading payment status from the mirrored tables. Webhook handling runs automatically through HTTP routes you register in convex/http.ts.

Use with agents and CLI

Give your coding agent the component’s source identity and setup guidance.

agent-prompt.md
Help me integrate OxaPay with Bijection.

Read: https://bijection.com/components/convex-oxapay/SKILL.md

Check SDK compatibility and dependency availability.
Follow this project's execution and verification rules.

Upstream README.md

View repository ↗

Documentation from BradPerbs/convex-oxapay, recorded October 23, 2026. APIs and setup may differ in the Bijection adaptation.

convex-oxapay

A Convex Component for OxaPay, the crypto payment gateway that accepts Bitcoin, Ethereum, USDT, USDC, and dozens of other cryptocurrencies on multiple networks.

convex-oxapay gives you:

  • Hosted invoices with a one-call API and an automatically mirrored status table.
  • White-label payments for fully custom checkout UIs.
  • Static deposit addresses for wallet top-ups and crypto subscriptions.
  • Payouts with status tracking.
  • Swap, balance, prices, and reference data from a single client object.
  • Webhook handler with constant-time HMAC-SHA512 verification and idempotent dedup.
  • Live-subscribed React component + hook for instant payment status updates.

The component mirrors every OxaPay payment and payout into your Convex deployment so you can useQuery the latest status from your frontend without round-tripping to OxaPay's API.


Demo

See the live demo →


Table of contents


Installation

npm install convex-oxapay

Requires:

  • convex ^1.29.0 (peer dependency, auto-installed by npm 7+; install manually with npm install convex if needed)
  • An OxaPay account (sign up). You'll need at minimum a Merchant API key; the Payout key and General key are only required if you use payouts/swap/balance.

1. Add the component to your Convex app

// convex/convex.config.ts
import { defineApp } from "convex/server";
import oxapay from "convex-oxapay/convex.config";

const app = defineApp();
app.use(oxapay);

export default app;

2. Set environment variables on your Convex deployment

npx convex env set OXAPAY_MERCHANT_API_KEY  XXXXXX-XXXXXX-XXXXXX-XXXXXX
# Only needed if you create payouts:
npx convex env set OXAPAY_PAYOUT_API_KEY    XXXXXX-XXXXXX-XXXXXX-XXXXXX
# Only needed if you call /general (swap, balance):
npx convex env set OXAPAY_GENERAL_API_KEY   XXXXXX-XXXXXX-XXXXXX-XXXXXX
# Optional: defaults to false. Send sandbox: true on all createInvoice calls.
npx convex env set OXAPAY_SANDBOX           true

⚠️ OxaPay uses the merchant or payout API key itself as the HMAC secret for webhook verification. There is no separate webhook secret. Keep these keys server-side only.


Configuration

// convex/oxapay.ts
import { OxaPay } from "convex-oxapay";
import { components } from "./_generated/api";

export const oxapay = new OxaPay(components.oxapay, {
  // All fields are optional. Defaults come from env vars.
  merchantApiKey: process.env.OXAPAY_MERCHANT_API_KEY,
  payoutApiKey:   process.env.OXAPAY_PAYOUT_API_KEY,
  generalApiKey:  process.env.OXAPAY_GENERAL_API_KEY,
  baseUrl:        process.env.OXAPAY_BASE_URL,        // for proxies / mocks
  defaultCallbackUrl:
    "https://your-app.convex.site/oxapay/webhook",   // auto-sent on every payment
  sandbox: false,                                     // send sandbox: true by default
});
Config fieldEnv varRequired for
merchantApiKeyOXAPAY_MERCHANT_API_KEYInvoices, white-label, static, webhooks
payoutApiKeyOXAPAY_PAYOUT_API_KEYPayouts + payout webhooks
generalApiKeyOXAPAY_GENERAL_API_KEYBalance, swap
baseUrlOXAPAY_BASE_URLOptional override
sandboxOXAPAY_SANDBOXDefault-on sandbox flag for invoices
defaultCallbackUrl(none)Convenience: set the webhook URL once

Quickstart

Once you've registered the component and instantiated OxaPay:

// convex/payments.ts
import { v } from "convex/values";
import { action, query } from "./_generated/server";
import { oxapay } from "./oxapay";

/** Create a USD-priced crypto invoice and return its hosted URL. */
export const createInvoice = action({
  args: { amount: v.number() },
  handler: async (ctx, args) => {
    const identity = await ctx.auth.getUserIdentity();
    if (!identity?.subject) throw new Error("Not authenticated");

    const { trackId, paymentUrl } = await oxapay.payments.createInvoice(ctx, {
      entityId: identity.subject,        // links this payment to your user
      amount: args.amount,
      currency: "USD",
      description: "Premium upgrade",
      orderId: identity.subject,         // round-tripped to the webhook
      lifetime: 60,                      // minutes (15..2880)
    });

    return { trackId, paymentUrl };
  },
});

/** Live status query. Re-renders whenever the webhook updates the mirror. */
export const getPayment = query({
  args: { trackId: v.string() },
  handler: async (ctx, args) => {
    return await oxapay.payments.get(ctx, { trackId: args.trackId });
  },
});

And in your React frontend:

import { useState } from "react";
import { useAction, useQuery } from "convex/react";
import { api } from "../convex/_generated/api";

function PaymentFlow() {
  const [trackId, setTrackId] = useState<string | null>(null);
  const createInvoice = useAction(api.payments.createInvoice);
  const payment = useQuery(
    api.payments.getPayment,
    trackId ? { trackId } : "skip",
  );

  return (
    <>
      <button
        onClick={async () => {
          const { trackId, paymentUrl } = await createInvoice({ amount: 25 });
          setTrackId(trackId);
          window.open(paymentUrl, "_blank");
        }}
      >
        Pay $25 with crypto
      </button>

      {payment && (
        <p>
          Status: <strong>{payment.status}</strong>
        </p>
      )}
    </>
  );
}

Webhook setup

OxaPay sends webhooks back to your deployment when a payment changes status. convex-oxapay handles signature verification, idempotent dedup, and mirror updates for you.

// convex/http.ts
import { httpRouter } from "convex/server";
import { internal } from "./_generated/api";
import { oxapay } from "./oxapay";

const http = httpRouter();

oxapay.registerRoutes(http, {
  path: "/oxapay/webhook",         // default
  events: {
    // Fires for invoice / white-label / static-address payments
    "payment.paid": async (ctx, event) => {
      // event.order_id is whatever you sent at creation
      await ctx.runMutation(internal.users.markPremium, {
        entityId: (event as any).order_id,
      });
    },
    "payment.expired": async (ctx, event) => {
      console.log("expired", (event as any).track_id);
    },
    "payout.confirmed": async (ctx, event) => {
      console.log("payout confirmed", (event as any).track_id);
    },
  },
});

export default http;

Then in the OxaPay dashboard, set the webhook URL to:

https://<your-deployment>.convex.site/oxapay/webhook

(Find your deployment URL with npx convex dashboard or npx convex env get CONVEX_SITE_URL.)

Event handler keys

You can register handlers at any specificity. All matching handlers run sequentially, most-specific first.

KeyMatches
invoice.paidOnly the paid status on hosted invoices
invoice.*Every status update on hosted invoices
white_label.paidOnly paid on white-label payments
static_address.paidOnly paid on static-address deposits
payment_link.paidOnly paid on payment links
donation.paidOnly paid on donations
payment.paidAny payment-family event with paid status
payment.*Any payment-family event regardless of status
payout.confirmedOnly confirmed status on payouts
payout.*Any status update on payouts
*Every event

You can also pass onEvent for a catch-all that runs after the specific handlers.

Built-in webhook behavior

For every verified delivery, BEFORE your handlers run, the component:

  1. Hashes (track_id, status, tx_hash) and checks the processedWebhooks table. Repeat deliveries become no-ops.
  2. Upserts the payment / payout row in the mirror table.
  3. Forward-only status transitions: refuses to downgrade paid → waiting, but allows paid → refunding.

OxaPay requires HTTP 200 with body "ok" to consider the delivery acknowledged. The component returns exactly that. Any other response triggers OxaPay's retry schedule (5 attempts: 1 min, 3 min, 30 min, 3 h).


API reference

All methods on oxapay accept a Convex action ctx (with runQuery / runMutation / runAction) as their first argument. The exceptions are the namespaces that talk directly to OxaPay (swap, account, common) and staticAddresses.listFromProvider. Those don't touch the Convex DB so they don't need a ctx.

oxapay.payments

MethodPurpose
createInvoice(ctx, args)Create a hosted invoice on OxaPay and mirror it. Returns the paymentUrl.
createWhiteLabel(ctx, args)Create a white-label payment. Get raw address, payAmount, qrCode.
refresh(ctx, { trackId })Re-fetch from OxaPay and update the mirror. Fallback if webhook is missed.
get(ctx, { trackId })Read the mirror row.
listForEntity(ctx, { entityId, status?, limit? })List payments tied to one entityId, optionally filtered by status.
listByStatus(ctx, { status, limit? })List all payments at a given status.
getByOrderId(ctx, { orderId })Look up by the order_id you provided at creation.
listFromProvider(args)Bypass the mirror and query OxaPay's /payment endpoint directly.

createInvoice args:

{
  entityId: string | null;        // your app's user/org id, or null for anonymous
  amount: number;                 // priced amount
  currency?: string;              // default "USD"; supports fiats and cryptos
  lifetime?: number;              // minutes, 15..2880, default 60
  feePaidByPayer?: 0 | 1;         // who pays the OxaPay fee
  underPaidCoverage?: number;     // %, 0..60
  toCurrency?: string;            // auto-convert receipts into this crypto
  autoWithdrawal?: boolean;       // sweep to your linked external wallet
  mixedPayment?: boolean;         // allow paying remainder in a 2nd coin
  callbackUrl?: string;           // override the default callback URL
  returnUrl?: string;
  email?: string;
  orderId?: string;               // round-tripped to the webhook
  thanksMessage?: string;
  description?: string;
  sandbox?: boolean;              // override the global sandbox flag
  metadata?: Record<string, unknown>;  // stored on the mirror row
}

oxapay.staticAddresses

const { trackId, address, qrCode } = await oxapay.staticAddresses.create(ctx, {
  entityId: identity.subject,
  network: "Tron",          // "Bitcoin" | "Ethereum" | "Tron" | "BSC" | etc.
  toCurrency: "USDT",       // auto-convert receipts into USDT
  autoWithdrawal: false,
  description: "Wallet top-up",
});
MethodPurpose
create(ctx, args)Provision a permanent address. Auto-revoked after 6 months of inactivity.
revoke(ctx, { address })Manually revoke a static address.
listFromProvider(args)List static addresses from OxaPay (/payment/static-address).

oxapay.payouts

const { trackId, status } = await oxapay.payouts.create(ctx, {
  entityId: userId,
  address: "1A1z7agoat...",
  currency: "BTC",
  network: "Bitcoin",
  amount: 0.5,
  description: "Withdrawal request #42",
});
MethodPurpose
create(ctx, args)Submit a payout / withdrawal.
refresh(ctx, { trackId })Re-fetch and update the mirror.
get(ctx, { trackId })Read the mirror row.
listForEntity(ctx, { entityId, status?, limit? })List a user's payouts.
listFromProvider(args)Bypass the mirror and query OxaPay's /payout endpoint directly.

oxapay.swap

Direct passthrough to OxaPay's swap engine. Not mirrored locally.

const { rate } = await oxapay.swap.rate({ fromCurrency: "BTC", toCurrency: "USDT" });
const { toAmount } = await oxapay.swap.calculate({ fromCurrency: "BTC", toCurrency: "USDT", amount: 0.01 });
const swap = await oxapay.swap.execute({ fromCurrency: "BTC", toCurrency: "USDT", amount: 0.01 });
const { list } = await oxapay.swap.pairs();
const history = await oxapay.swap.history({ size: 50 });

oxapay.account

const balance = await oxapay.account.balance();
// { BTC: { available: 0.5, pending: 0 }, USDT: { available: 100, pending: 5 } }
const { list } = await oxapay.account.acceptedCurrencies();

oxapay.common

Unauthenticated reference data, useful for building currency pickers.

await oxapay.common.prices();      // { BTC: 79105.23, ETH: 2228.58, ... }
await oxapay.common.currencies();  // { BTC: { networks: { Bitcoin: { withdraw_fee, ... } } } }
await oxapay.common.fiats();       // { USD: { price: 1, display_precision: 0.001 }, ... }
await oxapay.common.networks();    // { list: ["Bitcoin Network", "Ethereum Network", ...] }
await oxapay.common.monitor();     // { status: "OK" }

oxapay.registerRoutes

Mount the webhook handler on a Convex httpRouter.

oxapay.registerRoutes(http, {
  path: "/oxapay/webhook",        // default
  events: { "payment.paid": handler, "payout.confirmed": handler, ... },
  onEvent: async (ctx, event) => { /* catch-all */ },
});

oxapay.api({ resolve })

A destructurable bag of pre-built Convex actions. Re-export them and call from your frontend directly. The resolve callback maps a Convex auth identity to an entityId.

// convex/oxapay.ts (continued)
export const {
  createInvoice,
  createWhiteLabel,
  createStaticAddress,
  createPayout,
  refreshPayment,
  listMyPayments,
  listMyPayouts,
} = oxapay.api({
  resolve: async (ctx) => {
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) return null;
    return { entityId: identity.subject };
  },
});

Frontend:

const createInvoice = useAction(api.oxapay.createInvoice);
const myPayments    = useAction(api.oxapay.listMyPayments);

React helpers (convex-oxapay/react)

<OxaPayCheckoutButton />

A drop-in button that creates an invoice and either redirects or opens it in a new tab.

import { OxaPayCheckoutButton } from "convex-oxapay/react";
import { api } from "../convex/_generated/api";

<OxaPayCheckoutButton
  createInvoice={api.oxapay.createInvoice}
  invoiceArgs={{ amount: 50, currency: "USD" }}
  mode="new-tab"                       // "redirect" | "new-tab" | "none"
  onCreated={(r) => console.log(r)}
  onError={(e) => alert("Failed: " + e)}
>
  Pay $50 with crypto
</OxaPayCheckoutButton>

useOxaPayPayment(query, trackId)

A thin wrapper around useQuery that subscribes to a payment row by track id.

import { useOxaPayPayment } from "convex-oxapay/react";
import { api } from "../convex/_generated/api";

function Status({ trackId }: { trackId: string }) {
  const payment = useOxaPayPayment(api.payments.getPayment, trackId);
  if (!payment) return <p>Loading…</p>;
  return <p>Status: {payment.status}</p>;
}

Tables created in your deployment

The component creates these tables inside its isolated namespace (components.oxapay.*). They don't pollute your app's schema.

TablePurpose
customersOptional bridge: maps your entityId to OxaPay-aware customer record.
paymentsMirror of every invoice / white-label / static-address / link payment.
payoutsMirror of every withdrawal.
processedWebhooksDedup ledger so retried deliveries are no-ops. Pruned after 30 days.

All status comparisons should be case-insensitive. OxaPay returns lowercase via REST (paid) and TitleCase via webhooks (Paid). The mirror preserves the verbatim casing.


Status reference

Payment lifecycle

new → waiting → paying → paid           ← happy path
                      ↘ underpaid       ← partial payment
                      ↘ expired         ← lifetime elapsed
              paid → refunding → refunded

The component's mirror is forward-only: paid cannot regress to waiting, but paid → refunded is allowed.

Payout lifecycle

processing → pending → confirming → confirmed
                                  ↘ rejected
                                  ↘ canceled

Recommended events map for SaaS billing

events: {
  "payment.paid":     async (ctx, e) => { /* fulfill order */ },
  "payment.expired":  async (ctx, e) => { /* mark expired   */ },
  "payment.underpaid": async (ctx, e) => { /* notify support */ },
  "payout.confirmed": async (ctx, e) => { /* mark withdrawal complete */ },
  "payout.rejected":  async (ctx, e) => { /* refund the user */ },
}

Testing

The package ships a convex-test helper at convex-oxapay/test:

// example/convex/setup.test.ts
import { convexTest } from "convex-test";
import schema from "./schema";
import component from "convex-oxapay/test";

const modules = import.meta.glob("./**/*.ts");

export function initConvexTest() {
  const t = convexTest(schema, modules);
  component.register(t);    // registers the "oxapay" component
  return t;
}

Local development

git clone https://github.com/bradperbs/convex-oxapay
cd convex-oxapay
npm install
npm run dev          # convex dev + watcher rebuilding TS
npm run dev:frontend # runs the example/ React app on Vite
npm test
npm run build

For the example app, set VITE_CONVEX_URL in example/.env.local:

VITE_CONVEX_URL=https://<your-deployment>.convex.cloud

Troubleshooting

My webhook is returning 403

The signature didn't verify. Common causes:

  • You sent merchant_api_key from one OxaPay account but the webhook was signed by another.
  • A proxy / load balancer is altering the request body before it reaches Convex. The HMAC is computed over the exact raw bytes.
  • You set the wrong env var (the webhook uses your merchant key, or your payout key when event.type === "payout").

My webhook is returning 500

Check the Convex logs. The most likely cause is an error inside your custom event handler. The component catches verification errors but not handler errors (so OxaPay retries on transient failures).

I'm getting "OxaPay API error (401)"

The key is wrong, blank, or you're calling the wrong endpoint family. Re-check OXAPAY_MERCHANT_API_KEY vs OXAPAY_PAYOUT_API_KEY vs OXAPAY_GENERAL_API_KEY.

A payment was paid but my user wasn't upgraded

Check the processedWebhooks table. The eventKey is (type, trackId, status, tx_hash). If you see the entry, the webhook reached your deployment; the issue is in your handler. If you don't see it, the webhook never arrived. Check the OxaPay dashboard's webhook log.

Static addresses stopped working after a few months

OxaPay automatically revokes static addresses that have no incoming transactions for 6 months. Recreate the address via oxapay.staticAddresses.create(...).

My invoice was paid after expired_at

Funds sent to an OxaPay invoice address after the lifetime elapses are unrecoverable. Always quote a generous lifetime (the maximum is 2880 minutes = 48 hours).


License

Apache-2.0. See LICENSE.

Keywords