#CLINK plugin for #BTCpayServer finally approved and listed in the plugin directory 🥳

Thank you

team for your relentless feedback, I’ve learned so much more in the past two months 🙏

https://stacker.news/items/1559179/r/06bc1a977d

nostr:npub155m2k8ml8sqn8w4dhh689vdv0t2twa8dgvkpnzfggxf4wfughjsq2cdcvg #clink plugin v1.2.1 is out!

https://github.com/WoompaLoompa/btcpay-clink/releases#release-v1.2.1

New LNbits extension: #CLINK: Recurring #Lightning Payments, #Subscriptions Auto-Renew & Funding Source for #LNbits.

Nostr-native Lightning for LNbits: publish a noffer1... and get paid over Nostr, pay other offers, and run subscriptions with Lightning auto-renew via CLINK debits. No Lightning.Pub required. A list of CLINK-aware apps is available at clinkme.dev/apps.html

• Offers (receive), Pay Offers (send)
• Subscriptions auto-renewal (day/week/month plans)
• Wallet debits with per-period budgets & rules
• CLINK (e.g. Lightning.pub) as funding source

Announcement: https://stacker.news/items/1543884/r/06bc1a977d

Demo: https://clink-lnbits.fly.dev/

Repo: https://github.com/WoompaLoompa/lnbits-clink

GPL-3.0, PRs, issues and any feedback welcome!

#bitcoin #nostr #asknostr

v1.0.9 — Security Hardening (BOLT11 validation + guest-order authorization)

Summary

This release closes three security gaps identified in a plugin review: invoices were accepted without being validated against the order's network/amount/expiry, guest orders had no ownership check on the payment AJAX handlers, and save_ndebit trusted a client-supplied subscription ID.

Download and install from:

• GitHub https://github.com/WoompaLoompa/woo-clink/releases/tag/v1.0.9
• Wordpress https://wordpress.org/plugins/clink-gateway-for-woocommerce/

Security fixes

• Strict BOLT11 invoice validation — the invoice is parsed server-side (bech32 checksum, HRP network, amount, expiry) before payment is confirmed. Invoices that are invalid, on the wrong network, for an amount that doesn't match the order total (within 1 sat), or that expire in under 60 seconds are rejected in the checkout UI.
• Guest order-key authorization — all four payment AJAX handlers (check_payment, confirm_payment, mark_paid, save_ndebit) now require the matching order key for guest orders; logged-in users must match the order's customer ID. Previously guests could confirm/mark any order.
• Server-side subscription binding — save_ndebit no longer accepts a client-supplied subscription_id; subscription IDs are derived server-side from the verified order.

New

• Network setting (mainnet / testnet / regtest) added to the gateway configuration; invoices from a different network are rejected.
• Parsed invoice amount is recorded as _clink_invoice_amount_sats order meta.

Install / Update

1. Upload/install clink-gateway-for-woocommerce.zip (attached) or update from the WordPress.org plugin page.
2. WordPress 5.8+ / WooCommerce 3.0+ / PHP 7.4+ (tested up to WP 7.0.2).
3. If you're on testnet or regtest, set Bitcoin Network in WooCommerce → Settings → Payments → Lightning (CLINK) so invoices are validated against the right chain. https://cdn.nostrcheck.me/f4c1e3f156654869f7886d4b273f7cdc59a38f84423b7827f85720c803fae801.png

v1.0.2 update released in GH and npm

Security Hardening

• BOLT11 invoice validation: mainnet bc prefix, amount match, reasonable expiry; payment_hash extracted and stored on the session
• Webhook HMAC-SHA256 signature verification via CLINK_WEBHOOK_SECRET env var or webhookSecret option
• Webhook correlation: session existence, amount, and payment_hash matched before confirming; idempotent handling
• SSRF protection: relay URLs restricted to wss://, rejecting localhost/.local, private/loopback/CGNAT/link-local IPs, and unsafe IPv6 ranges
• nDebit validation: decode and validate debit pointers (type, pubkey, relay); requires safe relay and valid merchantPubkey
• k1 correlation key on debit requests (<subscription_id>:)

Added

• webhookSecret and merchantPubkey configuration options
• payment_hash on payment sessions; debit_pubkey/debit_relay on subscription data
• bolt11 and nostr-tools dependencies
• Expanded test suite (130 tests, 5 suites) with coverage thresholds met

npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink GitHub: https://github.com/WoompaLoompa/medusa-clink .

vendure-plugin-bitcoin-lightning-via-clink v0.3.0 released

Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes). npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink | GitHub: https://github.com/WoompaLoompa/vendure-clink

What's new in v0.3.0

• Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
• Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
• Invoice expiry validation — already-expired invoices are refused
• SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
• Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
• Atomic offer transitions — settlement/expiry only applies from pending state
• Event kind 21001 + p-tag correlation checks on relay receipts
• Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).

I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues

#buildstr #bitcoin #lightning #commerce #vendure #nostr #clink

MedusaJS is one of the fastest-growing open-source eCommerce frameworks, but despite its explosive growth in headless commerce, no Bitcoin Lightning module existed for MedusaJS. Until now. Built a MedusaJS module that enables Bitcoin Lightning payments for online stores using the CLINK protocol. Available via npm and GitHub.

Read more:

• https://stacker.news/items/1534561/r/06bc1a977d
• https://yakihonne.com/article/s/[email protected]/GyoUX3dJzUCaHQFyhrd1x

#bitcoin #commerce #ecommerce #lightning #clink #medusajs

Just dropped the #CLINK Payments Gateway for #Wordpress : Auto-renew subscriptions via Bitcoin Lightning, finally.

No third-party processor. No webhooks. No HTTP requests. No server for your node. Just a noffer, a Nostr relay, and the ndebit protocol doing the heavy lifting.

Merchants: generate a noffer1... in your CLINK wallet, paste it in WooCommerce, go.

Customers: scan a QR, pay, authorize auto-renewal once, never think about it again.

Recurring Lightning payments, fully self-sovereign.

Demo: https://woo-clink.wasmer.app

Code: https://github.com/WoompaLoompa/woo-clink

#Bitcoin #LightningNetwork #Nostr #WooCommerce #CLINK

Setup #CLINK plugin to enable #lightning payments Aupo-Renew for your

's Subscription plans.

Customers simply add a nDebit string to authorize future subscription plan payments