Settings

Handle the event payload

AuthentiChain sends JSON with the following structure:

{
  "event": "order.confirmed",   // or "order.refunded"
  "order_id": "uuid",
  "external_order_id": "your-id",  // if you passed one
  "amount_credits": 100,
  "amount_usd": "100.00",
  "user_phone": "+15550001234",
  "merchant_id": "uuid",
  "timestamp": "2024-01-01T00:00:00Z"
}

Verify the signature (strongly recommended)

Every request includes an X-AC-Signature header — an HMAC-SHA256 of the raw body signed with your API key. Verify it to prevent spoofed events:

// Node.js example
const crypto = require('crypto');

const sig = req.headers['x-ac-signature'];
const expected = crypto
  .createHmac('sha256', process.env.AC_API_KEY)
  .update(req.rawBody)           // raw Buffer, not parsed JSON
  .digest('hex');

if (sig !== expected) {
  return res.status(401).send('Invalid signature');
}
// ✓ Safe to process event
return res.status(200).send('ok');

Add a CNAME DNS record

In your DNS provider (Cloudflare, GoDaddy, Route53, etc.) add:

⏱ DNS changes can take up to 48 hours to propagate, though usually under 15 minutes.

Update your widget embed to use the custom domain

Change the src of your iframe to point to your domain instead of the default portal URL:

// Before (default Vercel URL)
src="https://authentichain-credits-portal.vercel.app/topup?mid=m_xxx"

// After (custom domain — merchant's own)
src="https://credits.yoursite.com/topup?mid=m_xxx"

The mid parameter stays the same — only the domain changes.