pull down to refresh

Built a MedusaJS plugin that enables Bitcoin Lightning payments for online stores using the CLINK protocol.
Available via npm and GitHub.

The gap:
MedusaJS is one of the fastest-growing open-source eCommerce frameworks (35K+ stars on GitHub, claimed $10B+ GMV global, ~150K monthly npm downloads). Despite explosive growth in headless commerce, no Bitcoin Lightning plugin existed for MedusaJS. Until now.

Market context:

  • Bitcoin payments ecosystem: $8.7B in 2026, projected $53.65B by 2035 (22.4% CAGR) — MarkWide Research
  • Lightning Network: $1.17B monthly volume, 266% YoY growth — River State of Lightning Report
  • Lightning avg transaction size doubled to $223 (up from $118) — River
  • Square opened Lightning to 4M US merchants with zero processing fees — Square
  • 8/10 crypto holders hold for investment, only ~20% use for shopping — huge untapped merchant adoption potential

What it does:

  • Accept Lightning payments on any MedusaJS store
  • Self-custodial: merchant optionally runs their own Lightning.pub node, no third-party custody
  • Instant settlement via Lightning Network
  • QR code + one-click copy for invoices payments
  • Auto currency conversion (CoinGecko, Kraken, Fixed rate, or manual)
  • Subscriptions via nDebit recurring payments that activate automatic renewals.
  • Dual confirmation: Webhook (primary) + Polling (backup)

Why CLINK?
CLINK (Common Lightning Interface for Nostr Keys) uses Nostr as transport layer with no web server required for your Lightning node if you chose Bootstrap on http://shockwallet.app. Self-custodial by design when you opt-in running your Lightning.pub node. Ephemeral keys for payment requests = better privacy than traditional payment processors.

Quick start:

npm install medusa-plugin-bitcoin-lightning-via-clink
// medusa-config.ts
{
  resolve: "medusa-plugin-bitcoin-lightning-via-clink",
  id: "clink",
  options: {
    noffer: "noffer1...",  // Your CLINK offer
    currencySource: "coingecko"
  }
}

Advantage:
Traditional card payments cost merchants 2-3% per transaction. Lightning costs a fraction of a cent. Let's not even consider all telemetry and tracking that can be done by third parties on all your fiat payments, done and received. CLINK offers zero traceability without any traceable HTTP/HTTPS calls. For a small business processing thousands of transactions/month, the savings are material. Plus: no chargebacks, instant settlement, no waiting for batch processing, it just works, 24/7, 365 days a year non stop.

Links:

Feedback welcome. Happy to answer any questions.

v1.0.2 update released in GH and npm

Security Hardening

  • BOLT11 invoice validation: mainnet bc prefix, amount match, reasonable expiry; payment_hash extracted and stored on the session
  • Webhook HMAC-SHA256 signature verification via CLINK_WEBHOOK_SECRET env var or webhookSecret option
  • Webhook correlation: session existence, amount, and payment_hash matched before confirming; idempotent handling
  • SSRF protection: relay URLs restricted to wss://, rejecting localhost/.local, private/loopback/CGNAT/link-local IPs, and unsafe IPv6 ranges
  • nDebit validation: decode and validate debit pointers (type, pubkey, relay); requires safe relay and valid merchantPubkey
  • k1 correlation key on debit requests (<subscription_id>:<count>)

Added

  • webhookSecret and merchantPubkey configuration options
  • payment_hash on payment sessions; debit_pubkey/debit_relay on subscription data
  • bolt11 and nostr-tools dependencies
  • Expanded test suite (130 tests, 5 suites) with coverage thresholds met

npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
GitHub: https://github.com/WoompaLoompa/medusa-clink
.

reply

I was not expecting this from npm in just two days

reply
reply

It’s crazy to see all these projects use CLINK!!

reply