Tempest Pay for developers

Core integration flow

1. Create or obtain a Tempest Pay secret key in the Tempest Touch developer area.
2. From your backend, create a charge with POST /api/v1/charges and an Idempotency-Key.
3. Redirect the customer to the returned hosted_url (or present the payment details returned by the API).
4. Receive webhook events on your server and verify the Tempest-Signature header against the raw request body.
5. Fulfill the order only after a verified charge.paid (or equivalent terminal paid state defined by your integration) event.

API and documentation

• Base URL: https://tempesttouchwallet.com/api/v1
• Human-readable integration guide
• Sandbox / test mode guide
• SDK & integration examples (Node, PHP, Python, plugins)
• Migration guide
• Machine-readable integration specification
• OpenAPI 3.x specification
• Postman collection
• LLMs.txt summary

Webhook security checklist

• Read the raw HTTP request body before JSON parsing.
• Verify Tempest-Signature using your webhook secret.
• Reject stale timestamps outside your tolerance window.
• Use the event ID for idempotency; process duplicate deliveries safely.
• Do not trust success/cancel redirect URLs alone for fulfillment.

# Pseudocode
raw = request.raw_body
sig = request.headers['Tempest-Signature']
if !verify_tempest_signature(raw, sig, WEBHOOK_SECRET): return 400
event = JSON.parse(raw)
if event.type == 'charge.paid': fulfill_once(event.id, event.data.object.reference)