Anonym Gateway API

Quick Start

curl -X POST https://anonympay.vercel.app/api/gateway/intents \
  -H "Authorization: Bearer $ANONYM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 10,
    "token": "MON",
    "description": "Premium subscription",
    "recipient_address": "0xYourReceivingAddress",
    "metadata": { "user_id": "user-123" }
  }'

const res = await fetch("https://anonympay.vercel.app/api/gateway/intents", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ANONYM_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: 10,
    token: "MON",
    description: "Premium subscription",
    recipient_address: "0xYourReceivingAddress",
    metadata: { user_id: "user-123" },
  }),
});

const { ok, data } = await res.json();
// data.id, data.status ("created"), data.vault_address, data.expires_at

Authentication

All API requests authenticate via Bearer token in the Authorization header. Your API key is shown once at creation — store it securely.

Authorization: Bearer sk_live_your_api_key_here

Base URL

https://anonympay.vercel.app/api/gateway

All endpoints are prefixed with /api/gateway. Rate limit: 100 requests per minute per API key.

Payment Flow

Endpoints

Example: Create Intent

{
  "amount": 25,
  "token": "MON",
  "description": "Annual subscription",
  "recipient_address": "0xYourReceivingAddress",
  "metadata": {
    "order_id": "ord_abc123",
    "plan": "annual"
  },
  "idempotency_key": "order_abc123_1",
  "expires_in_seconds": 1800
}

{
  "ok": true,
  "data": {
    "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "status": "created",
    "amount": 25,
    "token": "MON",
    "currency": "MON",
    "recipient_address": "0xYourReceivingAddress",
    "commitment_hash": "0x8a3f...",
    "salt": "0xb74e...",
    "vault_address": "0x53A617438fCd546fF7af234e832Ce270b12B3c1C",
    "expires_at": "2026-07-18T15:30:00Z",
    "created_at": "2026-07-18T14:30:00Z"
  }
}

Show your user the amount and vault_address. After they send MON on Monad and you see the transaction, confirm the intent:

{
  "tx_hash": "0x9c2f…the on-chain transfer hash",
  "deposit_id": 42
}

// Response: intent with "status": "paid" and "paid_at" set.
// A payment.paid webhook is delivered to your endpoints.

Managed Wallets (No Wallet Required)

For web2 users who don't have a crypto wallet, create a managed wallet. Each user gets a deterministic address derived from your merchant ID. Funds deposited here are automatically routed through Anonym vaults.

POST /api/gateway/managed-wallets
{
  "user_identifier": "user-123",
  "label": "Alice's payment wallet"
}

// Response
{
  "ok": true,
  "data": {
    "address": "0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18",
    "derivation_index": 1,
    "status": "active"
  }
}

Your user sends MON to the managed wallet address (from an exchange, fiat on-ramp, or another source). The system detects the deposit and routes it through the vault.

Hosted Checkout Integration

The hosted checkout is a Stripe-style payment page you redirect users to. It handles wallet connection, on-chain payment, vault routing, and confirmation — no custom UI needed on your end. Every API key gets this for free.

How It Works

Your App                    Anonym Gateway              Shopper
  │                              │                          │
  │  POST /intents ─────────────►│                          │
  │  ◄──── { id } ──────────────│                          │
  │                              │                          │
  │  redirect ──────────────────►│  /checkout/{id}          │
  │                              │  ◄───────────────────────│  (connects wallet)
  │                              │  GET /checkout/{id} ────►│
  │                              │  ◄──── intent data ──────│
  │                              │                          │
  │                              │  protocolTransfer() ────►│  (on-chain payment)
  │                              │  POST /checkout/{id}/confirm
  │                              │                          │
  │  webhook: payment.paid ──────│                          │
  │                              │                          │
  │  ◄────────────────────────── │  redirect to return_url  │

Step 1: Create a Payment Intent

Call this from your backend (never expose your API key in client code). The intent ID is what you redirect the user to.

curl -X POST https://anonympay.vercel.app/api/gateway/intents \
  -H "Authorization: Bearer $ANONYM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 25,
    "token": "MON",
    "description": "Pro plan — monthly",
    "recipient_address": "0xYourReceivingWallet",
    "metadata": { "order_id": "ord_abc123", "plan": "pro" },
    "expires_in_seconds": 3600
  }'

{
  "ok": true,
  "data": {
    "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "status": "created",
    "amount": 25,
    "token": "MON",
    "expires_at": "2026-07-18T15:30:00Z"
  }
}

Step 2: Build the Checkout URL

Append the intent ID to the checkout path. Optionally pass?return_url= to send the user back to your app after payment.

https://anonympay.vercel.app/checkout/{intent_id}?return_url=https://your-app.com/thank-you

const APP_URL = "https://anonympay.vercel.app";

const intent = await fetch("https://anonympay.vercel.app/api/gateway/intents", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ANONYM_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: 25,
    token: "MON",
    description: "Pro plan",
    recipient_address: "0xYourReceivingWallet",
  }),
}).then((r) => r.json());

const checkoutUrl = `${APP_URL}/checkout/${intent.data.id}?return_url=https://your-app.com/success`;

// Redirect the user, embed in an iframe, or show as a link
res.redirect(checkoutUrl);

Step 3: Receive Confirmation

When the user completes payment, they land on yourreturn_url. To know for sure the payment succeeded (and to verify the amount), listen for the webhook.

{
  "event": "payment.paid",
  "data": {
    "id": "f47ac10b-...",
    "status": "paid",
    "amount": 25,
    "token": "MON",
    "tx_hash": "0x9c2f...",
    "paid_at": "2026-07-18T15:31:00Z",
    "metadata": { "order_id": "ord_abc123", "plan": "pro" }
  }
}

The metadata field echoes back whatever you passed when creating the intent — use it to match payments to orders in your database.

Integration Examples

// app/api/checkout/route.ts
import { NextResponse } from "next/server";

const APP_URL = "https://anonympay.vercel.app";

export async function POST(req: Request) {
  const { amount, description } = await req.json();

  const res = await fetch("https://anonympay.vercel.app/api/gateway/intents", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.ANONYM_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ amount, token: "MON", description }),
  });

  const { ok, data, error } = await res.json();
  if (!ok) {
    return NextResponse.json({ error }, { status: 400 });
  }

  const checkoutUrl = `${APP_URL}/checkout/${data.id}?return_url=${encodeURIComponent("https://your-app.com/success")}`;

  return NextResponse.json({ checkoutUrl });
}

import os, requests
from flask import Flask, request, redirect

ANONYM_KEY = os.environ["ANONYM_API_KEY"]
ANONYM_BASE = "https://anonympay.vercel.app/api/gateway"
APP_URL = "https://anonympay.vercel.app"

@app.route("/checkout", methods=["POST"])
def checkout():
    amount = request.json["amount"]
    resp = requests.post(
        f"{ANONYM_BASE}/intents",
        headers={"Authorization": f"Bearer {ANONYM_KEY}"},
        json={"amount": amount, "token": "MON"},
    ).json()

    intent_id = resp["data"]["id"]
    checkout_url = f"{APP_URL}/checkout/{intent_id}?return_url=https://your-app.com/success"
    return redirect(checkout_url)

Webhooks

Register a webhook endpoint to receive payment notifications. Each request carries a SHA-256 signature so you can verify it came from Anonym. Your signing secret (whsec_…) is returned when you create the endpoint.

Event Types

Two events are delivered today. New endpoints subscribe to these by default; pass an events array when registering to narrow the set.

Register an endpoint

{
  "url": "https://your-app.com/webhooks/anonym",
  "events": ["payment.paid", "payment.settled"]
}

// Response includes the signing secret — store it, shown once:
// { "ok": true, "data": { "id": "...", "url": "...", "secret": "whsec_..." } }

Verifying Signatures

The signature is sha256("{timestamp}.{raw_body}.{secret}"). Compute it over the exact raw request body bytes — do not re-serialize the parsed JSON, or key ordering will change the hash.

X-Anonym-Signature: sha256=<hex_signature>
X-Anonym-Timestamp: <unix_timestamp>
X-Anonym-Event: payment.paid

import crypto from "crypto";

// rawBody: the exact string received, before JSON.parse
function verifyWebhook(rawBody, headers, secret) {
  const timestamp = headers["x-anonym-timestamp"];
  const signature = headers["x-anonym-signature"]; // "sha256=<hex>"

  const expected =
    "sha256=" +
    crypto
      .createHash("sha256")
      .update(`${timestamp}.${rawBody}.${secret}`)
      .digest("hex");

  // constant-time compare to avoid timing leaks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}

Error Handling

All errors return a consistent JSON structure with an error message and optional code.

{
  "ok": false,
  "error": "Amount must be positive",
  "code": "INVALID_AMOUNT"
}

Privacy Architecture

Every payment through the Gateway API is routed through Anonym vaults. The blockchain shows only vault interactions — never direct wallet-to-wallet transfers. Your users' financial relationships stay private.