1. Set up a VeilNebula account and project. In the dashboard at https://app.veilnebu.la, start in sandbox and create a live project after the full flow is verified.
2. Map charges to invoices. Keep your existing order identifier in externalId; save the returned invoice id and checkoutUrl.
3. Update code. Replace charge creation with signed POST /v1/payments. Send x-api-key, request-signature headers and a stable idempotency-key.
4. Update webhooks. Register your URL as a project webhook endpoint and store its signing secret as VEILNEBULA_WEBHOOK_SECRET. Receive the raw body, verify x-nebula-signature, deduplicate on eventId, and map payment.paid to fulfillment.

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const app = express();
const apiKey = process.env.VEILNEBULA_API_KEY;
const webhookSecret = process.env.VEILNEBULA_WEBHOOK_SECRET;

function verifyWebhook(rawBody, header) {
  const parts = Object.fromEntries(
    header.split(',').map((part) => part.trim().split('=', 2)),
  );
  const timestamp = Number(parts.t);
  if (!Number.isFinite(timestamp) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) return false;
  const expected = Buffer.from(
    createHmac('sha256', webhookSecret).update(parts.t + '.' + rawBody).digest('hex'),
  );
  const received = Buffer.from(parts.v1);
  return expected.length === received.length && timingSafeEqual(expected, received);
}

app.post('/checkout', express.json(), async (req, res) => {
  const orderId = String(req.body.orderId);
  const path = '/v1/payments';
  const body = JSON.stringify({
    // Coinbase local_price { amount: '25.00', currency: 'USD' } becomes minor units.
    amountMinor: String(Math.round(Number(req.body.totalUsd) * 100)),
    currencyCode: 'USD',
    settlementAssetCode: 'USDT',
    externalId: orderId,
    description: req.body.description,
    successUrl: 'https://merchant.example/paid',
    cancelUrl: 'https://merchant.example/cancelled',
  });
  const timestamp = new Date().toISOString();
  const signature = createHmac('sha256', apiKey)
    .update([timestamp, 'POST', path, body].join('.'))
    .digest('hex');
  const response = await fetch('https://api.veilnebu.la' + path, {
    method: 'POST',
    headers: {
      'content-type': 'application/json',
      'x-api-key': apiKey,
      'x-ncp-timestamp': timestamp,
      'x-ncp-signature': signature,
      'idempotency-key': 'coinbase-migration:' + orderId,
    },
    body,
  });
  if (!response.ok) return res.sendStatus(502);
  const invoice = await response.json();
  return res.redirect(303, invoice.checkoutUrl);
});

app.post('/webhooks/veilnebula', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  if (!verifyWebhook(rawBody, req.get('x-nebula-signature') ?? '')) {
    return res.sendStatus(400);
  }
  const event = JSON.parse(rawBody);
  if (event.event === 'payment.paid') {
    // Replaces charge:confirmed. Deduplicate on event.eventId.
  }
  return res.sendStatus(204);
});