Tempest Pay Integration Guide

1. Server-side setup

• Create a secret key in the Tempest Touch developer dashboard.
• Store it on your backend as TEMPEST_SECRET_KEY.
• Store the webhook secret as TEMPEST_WEBHOOK_SECRET.
• Never expose the secret key in browser or mobile code.

2. Create a charge

curl -X POST https://tempesttouchwallet.com/api/v1/charges   -H 'Authorization: Bearer $TEMPEST_SECRET_KEY'   -H 'Content-Type: application/json'   -H 'Idempotency-Key: order-1042'   -d '{
    "amount": "25.00",
    "currency": "USD",
    "title": "Order #1042",
    "reference": "1042"
  }'

The response includes a hosted_url and a unique payment address. Redirect the customer there or show the pay address in your checkout flow.

3. Handle webhooks

Always verify the raw request body against the Tempest-Signature header before fulfilling the order.

import crypto from 'node:crypto';
app.post('/webhooks/tempest', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.get('Tempest-Signature') || '';
  const parts = sig.split(',').map((p) => p.split('=', 2));
  const timestamp = Number(Object.fromEntries(parts).t);
  const raw = req.body;
  const expected = crypto.createHmac('sha256', process.env.TEMPEST_WEBHOOK_SECRET)
    .update(String(timestamp) + '.')
    .update(raw)
    .digest('hex');

  const valid = Number.isFinite(timestamp)
    && Math.abs(Date.now() / 1000 - timestamp) <= 300
    && parts.some(([k, v]) => k === 'v1' && crypto.timingSafeEqual(Buffer.from(v, 'hex'), Buffer.from(expected, 'hex')));

  if (!valid) return res.sendStatus(400);
  const event = JSON.parse(raw.toString('utf8'));
  if (event.type === 'charge.paid') {
    // fulfil event.data.object.reference
  }
  return res.sendStatus(200);
});

4. Webhook events

• charge.created
• charge.processing
• charge.partial_payment
• charge.paid
• charge.underpaid
• charge.expired
• charge.cancelled
• charge.late_payment

Use event.id for idempotent fulfilment. The same event can arrive more than once.

5. Going live

1. Complete identity verification.
2. Create a live key in the dashboard.
3. Replace the test secret in your backend with the live secret.
4. Point your live webhooks at the production endpoint.