pull down to refresh

Finally: Auto-Renew Subscriptions on Bitcoin Lightning (via CLINK)woo-clink.wasmer.app/2026/07/06/finally-auto-renew-subscriptions-on-bitcoin-lightning/
827 sats \ 13 comments \ @06bc1a977d 7 Jul lightning

Just shipped a Bitcoin Lightning Payment Gateway for WooCommerce — approved on WordPress.orgJust shipped a Bitcoin Lightning Payment Gateway for WooCommerce — approved on WordPress.org

Demo: https://woo-clink.wasmer.app
WP Plugin: https://wordpress.org/plugins/clink-gateway-for-woocommerce/
Code: https://github.com/WoompaLoompa/woo-clink

Inspired by CLINK, recently implemented in ZEUS, Amethyst and Electrum. Here's Woo-CLINK: no LND node, no server-side Lightning setup, no API keys. Just a CLINK-compatible wallet (ShockWallet, ZEUS, Amethyst) and a Nostr relay. Merchants can run it as a custodial setup simply by installing lightning.pub and connecting it as backend for ShockWallet.app.

How it works:

  1. Merchant pastes a noffer1... string from their wallet into the plugin settings
  2. Customer checks out → a BOLT 11 invoice is requested over Nostr
  3. QR code renders, customer pays with any Lightning wallet
  4. CLINK receipt confirms → order completes

Subscriptions & auto‑renewal:

  • After the first invoice payment, the customer authorizes recurring payments with an ndebit1... string (bech32 debit authorization)
  • Subsequent renewals happen automatically — no further interaction needed. Payments are deducted as long as funds are available in the source wallet
  • Customers can disable auto‑renewal anytime from WP > My Account

Other bits:

  • Price display in sats, BTC, or ₿ (bip-0177) — overrides all WooCommerce frontend prices
  • QR codes generated client‑side (no remote API)
  • Blocks checkout + classic checkout support
  • PHP 7.4+ / WP 5.8+ / Woo 6.0+

More coming soon. Would love feedback from you stackers. Anyone using WooCommerce want to give this a spin?

write
compose
related posts
2 sats \ 0 replies \ @06bc1a977d OP 2 Aug

v1.0.9 — Security Hardening (BOLT11 validation + guest-order authorization)v1.0.9 — Security Hardening (BOLT11 validation + guest-order authorization)

SummarySummary

This release closes three security gaps identified in a plugin review: invoices were accepted without being validated against the order's network/amount/expiry, guest orders had no ownership check on the payment AJAX handlers, and save_ndebit trusted a client-supplied subscription ID.

Download and install from:

Security fixesSecurity fixes

  • Strict BOLT11 invoice validation — the invoice is parsed server-side (bech32 checksum, HRP network, amount, expiry) before payment is confirmed. Invoices that are invalid, on the wrong network, for an amount that doesn't match the order total (within 1 sat), or that expire in under 60 seconds are rejected in the checkout UI.
  • Guest order-key authorization — all four payment AJAX handlers (check_payment, confirm_payment, mark_paid, save_ndebit) now require the matching order key for guest orders; logged-in users must match the order's customer ID. Previously guests could confirm/mark any order.
  • Server-side subscription binding — save_ndebit no longer accepts a client-supplied subscription_id; subscription IDs are derived server-side from the verified order.

NewNew

  • Network setting (mainnet / testnet / regtest) added to the gateway configuration; invoices from a different network are rejected.
  • Parsed invoice amount is recorded as _clink_invoice_amount_sats order meta.

Install / UpdateInstall / Update

  1. Upload/install clink-gateway-for-woocommerce.zip (attached) or update from the WordPress.org plugin page.
  2. WordPress 5.8+ / WooCommerce 3.0+ / PHP 7.4+ (tested up to WP 7.0.2).
  3. If you're on testnet or regtest, set Bitcoin Network in WooCommerce → Settings → Payments → Lightning (CLINK) so invoices are validated against the right chain.
reply
2 sats \ 0 replies \ @06bc1a977d OP 13 Jul
reply
2 sats \ 0 replies \ @DarthCoin 10 Jul
Merchants can run it as a custodial setup simply by installing lightning.pub and connecting it as backend for ShockWallet.app.

A correction here.
When you run it as a Lightning Pub, is in fact a full LND node in neutrino mode on your OWN hardware ! Can be whatever PC, now available on Umbrel and Start9 as standalone node software. That means self-custodial.

ShockWallet, on the other side, yes, it can be used custodial (using the bootstrap node from ShockNetwork) or connecting to your own LN Pub, or both.
So if you want only to test it as a merchant, you do not need to run Lightning Pub, just using ShockWallet is enough.

reply
38 sats \ 1 reply \ @BlokchainB 7 Jul

@AGORA @AG

Take a look 👀

reply
110 sats \ 0 replies \ @AG 8 Jul

We should! As the ecash one still unreliable apparently lol!

No response yet from our service provider, we will keep you posted

reply
49 sats \ 0 replies \ @02ad8239c2 8 Jul

good job, very thorough write up - and great to see CLINK getting some recognition and momentum in the wider network - need MOAR wallets supporting it !

reply
93 sats \ 4 replies \ @nullcount 8 Jul

Why do we need third party hosted infrastructure (nostr relays) when we already have a wordpress server that can relay/generate BOLT11 itself (supported by all LN wallets)?

Seems like unnecessary complexity to require user's wallets to implement CLINK when the recipient is always online.

reply
102 sats \ 3 replies \ @justin_shocknet 8 Jul -420 sats

Are you going to run a Lightning node on the Wordpress server? Wordpress doesn't generate invoices, lightning nodes do, and most people use Wordpress in a shared-hosting setting.

Nostr lets a web app, whatever that happens to be including static pages... reach the node without the node itself needing a web-server / static ip / tunnel etc.

Having a CLINK-enabled node then also enables more p2p-like use-cases from that same node, such as nostr-clients or even wallet-to-wallet with an noffer code.

Time to face the reality of what has stifled Lightning adoption: Setting up traditional web infrastructure just to reach your node is not for the faint of heart, and failing to do so simply results in a node being a cost-center that is useless unless you're purely a tinkerer that likes ending the day with less sats than you started with.

225 sats \ 1 reply \ @justin_shocknet 7 Jul -420 sats

Nice work, will add this to the site/docs