#CLINK plugin for #BTCpayServer finally approved and listed in the plugin directory 🥳

Thank you @BTCPay Server team for your relentless feedback, I’ve learned so much more in the past two months 🙏

https://stacker.news/items/1559179/r/06bc1a977d

Hitler tries a fake L2...

# @BTCPay Server #clink plugin v1.2.1 is out!

https://github.com/WoompaLoompa/btcpay-clink/releases#release-v1.2.1

New LNbits extension: #CLINK: Recurring #Lightning Payments, #Subscriptions Auto-Renew & Funding Source for #LNbits.

Nostr-native Lightning for LNbits: publish a `noffer1...` and get paid over Nostr, pay other offers, and run **subscriptions with Lightning auto-renew** via CLINK debits. No Lightning.Pub required. A list of CLINK-aware apps is available at `clinkme.dev/apps.html`

- Offers (receive), Pay Offers (send)
- Subscriptions auto-renewal (day/week/month plans)
- Wallet debits with per-period budgets & rules
- CLINK (e.g. Lightning.pub) as funding source

Announcement: https://stacker.news/items/1543884/r/06bc1a977d

Demo: https://clink-lnbits.fly.dev/

Repo: https://github.com/WoompaLoompa/lnbits-clink

GPL-3.0, PRs, issues and any feedback welcome!

#bitcoin #nostr #asknostr

# v1.0.9 — Security Hardening (BOLT11 validation + guest-order authorization)

### Summary
This release closes three security gaps identified in a plugin review: invoices were accepted without being validated against the order's network/amount/expiry, guest orders had no ownership check on the payment AJAX handlers, and `save_ndebit` trusted a client-supplied subscription ID.

Download and install from:

- GitHub https://github.com/WoompaLoompa/woo-clink/releases/tag/v1.0.9
- Wordpress https://wordpress.org/plugins/clink-gateway-for-woocommerce/


### Security fixes
- **Strict BOLT11 invoice validation** — the invoice is parsed server-side (bech32 checksum, HRP network, amount, expiry) before payment is confirmed. Invoices that are invalid, on the wrong network, for an amount that doesn't match the order total (within 1 sat), or that expire in under 60 seconds are rejected in the checkout UI.
- **Guest order-key authorization** — all four payment AJAX handlers (`check_payment`, `confirm_payment`, `mark_paid`, `save_ndebit`) now require the matching order key for guest orders; logged-in users must match the order's customer ID. Previously guests could confirm/mark any order.
- **Server-side subscription binding** — `save_ndebit` no longer accepts a client-supplied `subscription_id`; subscription IDs are derived server-side from the verified order.

### New
- **Network setting** (`mainnet` / `testnet` / `regtest`) added to the gateway configuration; invoices from a different network are rejected.
- Parsed invoice amount is recorded as `_clink_invoice_amount_sats` order meta.

### Install / Update
1. Upload/install `clink-gateway-for-woocommerce.zip` (attached) or update from the WordPress.org plugin page.
2. WordPress 5.8+ / WooCommerce 3.0+ / PHP 7.4+ (tested up to WP 7.0.2).
3. If you're on testnet or regtest, set **Bitcoin Network** in **WooCommerce → Settings → Payments → Lightning (CLINK)** so invoices are validated against the right chain.

# v1.0.2 update released in GH and npm

### Security Hardening
- BOLT11 invoice validation: mainnet bc prefix, amount match, reasonable expiry; payment_hash extracted and stored on the session
- Webhook HMAC-SHA256 signature verification via CLINK_WEBHOOK_SECRET env var or webhookSecret option
- Webhook correlation: session existence, amount, and payment_hash matched before confirming; idempotent handling
- SSRF protection: relay URLs restricted to wss://, rejecting localhost/.local, private/loopback/CGNAT/link-local IPs, and unsafe IPv6 ranges
- nDebit validation: decode and validate debit pointers (type, pubkey, relay); requires safe relay and valid merchantPubkey
- k1 correlation key on debit requests (<subscription_id>:<count>)

### Added
- webhookSecret and merchantPubkey configuration options
- payment_hash on payment sessions; debit_pubkey/debit_relay on subscription data
- bolt11 and nostr-tools dependencies
- Expanded test suite (130 tests, 5 suites) with coverage thresholds met

npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
GitHub: https://github.com/WoompaLoompa/medusa-clink
.

# vendure-plugin-bitcoin-lightning-via-clink v0.3.0 released

Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes). npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink | GitHub: https://github.com/WoompaLoompa/vendure-clink

### What's new in v0.3.0
- Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
- Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
- Invoice expiry validation — already-expired invoices are refused
- SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
- Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
- Atomic offer transitions — settlement/expiry only applies from pending state
- Event kind 21001 + p-tag correlation checks on relay receipts
- Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).

I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues

#buildstr #bitcoin #lightning #commerce #vendure #nostr #clink

MedusaJS is one of the fastest-growing open-source eCommerce frameworks, but despite its explosive growth in headless commerce, no Bitcoin Lightning module existed for MedusaJS. Until now. Built a MedusaJS module that enables Bitcoin Lightning payments for online stores using the CLINK protocol. Available via npm and GitHub.


Read more:
- https://stacker.news/items/1534561/r/06bc1a977d
- https://yakihonne.com/article/s/[email protected]/GyoUX3dJzUCaHQFyhrd1x

#bitcoin #commerce #ecommerce #lightning #clink #medusajs

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK
https://github.com/WoompaLoompa/medusa-clink


Built a MedusaJS plugin that enables Bitcoin Lightning payments for online stores using the CLINK protocol.
Available via [npm](https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink) and [GitHub](https://github.com/WoompaLoompa/medusa-clink).


**The gap:**
[MedusaJS](jttps://https://medusajs.com) is one of the fastest-growing open-source eCommerce frameworks ([35K+ stars](https://github.com/medusajs/medusa) on GitHub, claimed [$10B+ GMV](https://unsubbed.co/tools/medusa/) global, [~150K monthly](https://next-levels.de/en/medusa/) `npm` downloads). Despite explosive growth in headless commerce, no Bitcoin Lightning plugin existed for MedusaJS. Until now.

**Market context:**
- Bitcoin payments ecosystem: $8.7B in 2026, projected $53.65B by 2035 (22.4% CAGR) — MarkWide Research
- Lightning Network: $1.17B monthly volume, 266% YoY growth — River State of Lightning Report
- Lightning avg transaction size doubled to $223 (up from $118) — River
- Square opened Lightning to 4M US merchants with zero processing fees — Square
- 8/10 crypto holders hold for investment, only ~20% use for shopping — huge untapped merchant adoption potential

**What it does:**
- Accept Lightning payments on any MedusaJS store
- Self-custodial: merchant optionally runs their own Lightning.pub node, no third-party custody
- Instant settlement via Lightning Network
- QR code + one-click copy for invoices payments
- Auto currency conversion (CoinGecko, Kraken, Fixed rate, or manual)
- Subscriptions via nDebit recurring payments that activate automatic renewals.
- Dual confirmation: Webhook (primary) + Polling (backup)

**Why CLINK?**
[CLINK](https://stacker.news/items/1248472/r/06bc1a977d) (Common Lightning Interface for Nostr Keys) uses Nostr as transport layer with no web server required for your Lightning node if you chose Bootstrap on [ShockWallet.app](ShockWallet.app). Self-custodial by design when you opt-in running your [Lightning.pub](https://Lightning.pub) node. Ephemeral keys for payment requests = better privacy than traditional payment processors.

**Quick start:**
```
npm install medusa-plugin-bitcoin-lightning-via-clink
```

```typescript
// medusa-config.ts
{
resolve: "medusa-plugin-bitcoin-lightning-via-clink",
id: "clink",
options: {
noffer: "noffer1...", // Your CLINK offer
currencySource: "coingecko"
}
}
```

**Advantage:**
Traditional card payments cost merchants 2-3% per transaction. Lightning costs a fraction of a cent. Let's not even consider all telemetry and tracking that can be done by third parties on all your fiat payments, done and received. CLINK offers zero traceability without any traceable HTTP/HTTPS calls. For a small business processing thousands of transactions/month, the savings are material. Plus: no chargebacks, instant settlement, no waiting for batch processing, it just works, 24/7, 365 days a year non stop.

**Links:**
- npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
- GitHub: https://github.com/WoompaLoompa/medusa-clink
- Wiki: https://github.com/WoompaLoompa/medusa-clink/wiki


Feedback welcome. Happy to answer any questions.

https://stacker.news/items/1534561

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK
https://github.com/WoompaLoompa/medusa-clink


Built a MedusaJS plugin that enables Bitcoin Lightning payments for online stores using the CLINK protocol. Available via [npm](https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink) and [GitHub](https://github.com/WoompaLoompa/medusa-clink).


**The gap:**
[MedusaJS](jttps://https://medusajs.com) is one of the fastest-growing open-source eCommerce frameworks ([35K+ stars](https://github.com/medusajs/medusa) on GitHub, claimed [$10B+ GMV](https://unsubbed.co/tools/medusa/) global, [~150K monthly](https://next-levels.de/en/medusa/) `npm` downloads). Despite explosive growth in headless commerce, no Bitcoin Lightning plugin existed for MedusaJS. Until now.

**Market context:**
- Bitcoin payments ecosystem: $8.7B in 2026, projected $53.65B by 2035 (22.4% CAGR) — MarkWide Research
- Lightning Network: $1.17B monthly volume, 266% YoY growth — River State of Lightning Report
- Lightning avg transaction size doubled to $223 (up from $118) — River
- Square opened Lightning to 4M US merchants with zero processing fees — Square
- 8/10 crypto holders hold for investment, only ~20% use for shopping — huge untapped merchant adoption potential

**What it does:**
- Accept Lightning payments on any MedusaJS store
- Self-custodial: merchant optionally runs their own Lightning.pub node, no third-party custody
- Instant settlement via Lightning Network
- QR code + one-click copy for invoices payments
- Auto currency conversion (CoinGecko, Kraken, Fixed rate, or manual)
- Subscriptions via nDebit recurring payments that activate automatic renewals.
- Dual confirmation: Webhook (primary) + Polling (backup)

**Why CLINK?**
[CLINK](https://stacker.news/items/1248472/r/06bc1a977d) (Common Lightning Interface for Nostr Keys) uses Nostr as transport layer with no web server required for your Lightning node if you chose Bootstrap on [ShockWallet.app](ShockWallet.app). Self-custodial by design when you opt-in running your [Lightning.pub](https://Lightning.pub) node. Ephemeral keys for payment requests = better privacy than traditional payment processors.

**Quick start:**
```
npm install medusa-plugin-bitcoin-lightning-via-clink
```

```typescript
// medusa-config.ts
{
resolve: "medusa-plugin-bitcoin-lightning-via-clink",
id: "clink",
options: {
noffer: "noffer1...", // Your CLINK offer
currencySource: "coingecko"
}
}
```

**Advantage:**
Traditional card payments cost merchants 2-3% per transaction. Lightning costs a fraction of a cent. Let's not even consider all telemetry and tracking that can be done by third parties on all your fiat payments, done and received. CLINK offers zero traceability without any traceable HTTP/HTTPS calls. For a small business processing thousands of transactions/month, the savings are material. Plus: no chargebacks, instant settlement, no waiting for batch processing, it just works, 24/7, 365 days a year non stop.

**Links:**
- npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
- GitHub: https://github.com/WoompaLoompa/medusa-clink
- Wiki: https://github.com/WoompaLoompa/medusa-clink/wiki


Feedback welcome. Happy to answer any questions.

https://stacker.news/items/1534561

Just dropped the #CLINK Payments Gateway for #Wordpress : Auto-renew subscriptions via Bitcoin Lightning, finally.

No third-party processor. No webhooks. No HTTP requests. No server for your node. Just a noffer, a Nostr relay, and the ndebit protocol doing the heavy lifting.

Merchants: generate a noffer1... in your CLINK wallet, paste it in WooCommerce, go.



Customers: scan a QR, pay, authorize auto-renewal once, never think about it again.



Recurring Lightning payments, fully self-sovereign.

Demo: https://woo-clink.wasmer.app

Code: https://github.com/WoompaLoompa/woo-clink

#Bitcoin #LightningNetwork #Nostr #WooCommerce #CLINK