1. Create an account and project. In the dashboard at https://app.veilnebu.la, create a sandbox project first, then a live project when the integration is verified.
2. Issue a project API key. Store it as VEILNEBULA_API_KEY; never expose it in browser code.
3. Swap the invoice endpoint. Replace the provider create-invoice call with POST https://api.veilnebu.la/v1/payments.
4. Update headers. Replace merchant and sign with x-api-key, x-ncp-timestamp, x-ncp-signature, and a stable idempotency-key.
5. Register the webhook endpoint. Add your URL as a project webhook endpoint instead of sending url_callback per invoice, and store its signing secret as VEILNEBULA_WEBHOOK_SECRET.
6. Test the checkout and webhook. Create a sandbox invoice, redirect to checkoutUrl, and use the dashboard webhook test before processing live orders.
7. Go live. Change credentials and endpoint configuration only after replay protection and signature verification pass.

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const app = express();
const apiKey = process.env.VEILNEBULA_API_KEY;
const webhookSecret = process.env.VEILNEBULA_WEBHOOK_SECRET;

function signedHeaders(method, path, body, idempotencyKey) {
  const timestamp = new Date().toISOString();
  const signature = createHmac('sha256', apiKey)
    .update([timestamp, method, path, body].join('.'))
    .digest('hex');
  return {
    'content-type': 'application/json',
    'x-api-key': apiKey,
    'x-ncp-timestamp': timestamp,
    'x-ncp-signature': signature,
    'idempotency-key': idempotencyKey,
  };
}

function verifyWebhook(rawBody, header) {
  const parts = Object.fromEntries(
    header.split(',').map((part) => part.trim().split('=', 2)),
  );
  const timestamp = Number(parts.t);
  if (!Number.isFinite(timestamp) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) return false;
  const expected = Buffer.from(
    createHmac('sha256', webhookSecret).update(parts.t + '.' + rawBody).digest('hex'),
  );
  const received = Buffer.from(parts.v1);
  return expected.length === received.length && timingSafeEqual(expected, received);
}

app.post('/pay', express.json(), async (req, res) => {
  const orderId = String(req.body.orderId);
  const path = '/v1/payments';
  const body = JSON.stringify({
    amountMinor: '250000', // 2500.00 USD in cents
    currencyCode: 'USD',
    settlementAssetCode: 'USDT',
    externalId: orderId,
    description: 'Order ' + orderId,
    successUrl: 'https://merchant.example/paid',
    cancelUrl: 'https://merchant.example/cancelled',
  });
  const response = await fetch('https://api.veilnebu.la' + path, {
    method: 'POST',
    headers: signedHeaders('POST', path, body, 'order-' + orderId),
    body,
  });
  if (!response.ok) return res.sendStatus(502);
  const invoice = await response.json();
  return res.redirect(303, invoice.checkoutUrl);
});

app.post('/webhooks/veilnebula', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  if (!verifyWebhook(rawBody, req.get('x-nebula-signature') ?? '')) {
    return res.sendStatus(400);
  }
  const event = JSON.parse(rawBody);
  if (event.event === 'payment.paid') {
    // Deduplicate on event.eventId, then fulfil the order in event.externalId.
  }
  return res.sendStatus(204);
});

<?php
function createInvoice(string $apiKey, string $orderId, string $amountMinor): array
{
    $path = '/v1/payments';
    $body = json_encode([
        'amountMinor' => $amountMinor, // minor units: '250000' = 2500.00 USD
        'currencyCode' => 'USD',
        'settlementAssetCode' => 'USDT',
        'externalId' => $orderId,
        'description' => 'Order ' . $orderId,
        'successUrl' => 'https://merchant.example/paid',
        'cancelUrl' => 'https://merchant.example/cancelled',
    ], JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
    $timestamp = gmdate('Y-m-d\TH:i:s\Z');
    $signature = hash_hmac('sha256', implode('.', [$timestamp, 'POST', $path, $body]), $apiKey);

    $ch = curl_init('https://api.veilnebu.la' . $path);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $body,
        CURLOPT_HTTPHEADER => [
            'content-type: application/json',
            'x-api-key: ' . $apiKey,
            'x-ncp-timestamp: ' . $timestamp,
            'x-ncp-signature: ' . $signature,
            'idempotency-key: order-' . $orderId,
        ],
        CURLOPT_RETURNTRANSFER => true,
    ]);
    $response = curl_exec($ch);
    if ($response === false) throw new RuntimeException(curl_error($ch));
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    if ($status < 200 || $status >= 300) throw new RuntimeException('VeilNebula API returned ' . $status);
    return json_decode($response, true, flags: JSON_THROW_ON_ERROR);
}

function verifyWebhook(string $raw, string $signatureHeader, string $secret): bool
{
    if (!preg_match('/t=(\d+),v1=([0-9a-f]+)/', $signatureHeader, $matches)) return false;
    if (abs(time() - (int) $matches[1]) > 300) return false;
    $expected = hash_hmac('sha256', $matches[1] . '.' . $raw, $secret);
    return hash_equals($expected, $matches[2]);
}

function handleWebhook(string $raw, string $signatureHeader, string $secret): void
{
    if (!verifyWebhook($raw, $signatureHeader, $secret)) {
        http_response_code(400);
        return;
    }
    $event = json_decode($raw, true, flags: JSON_THROW_ON_ERROR);
    if ($event['event'] === 'payment.paid') {
        // Deduplicate on $event['eventId'], then fulfil $event['externalId'].
    }
    http_response_code(204);
}

$orderId = $_POST['orderId'] ?? 'order-1001';
$amountMinor = $_POST['amountMinor'] ?? '250000';
$invoice = createInvoice(getenv('VEILNEBULA_API_KEY') ?: '', $orderId, $amountMinor);
header('Location: ' . $invoice['checkoutUrl'], response_code: 303);

// In the webhook route, call:
// handleWebhook(file_get_contents('php://input'), $_SERVER['HTTP_X_NEBULA_SIGNATURE'] ?? '', getenv('VEILNEBULA_WEBHOOK_SECRET') ?: '');