pull down to refresh

Here is a Vendure plugin that accepts Bitcoin Lightning payments via the CLINK protocol (Nostr-native static payment codes).

What it doesWhat it does

  • Accepts BTC Lightning payments in any Vendure e-commerce store
  • Real-time BTC/USD price oracle (CoinGecko, Kraken, custom)
  • Per-channel Nostr keypair and relay configuration
  • HTTP webhook fallback for wallets without Nostr support
  • Storefront React component with relay info display
  • Payment verification: preimage hash check, BOLT11 amount validation, HMAC webhook auth

Why this matters for Bitcoin payments in e-commerceWhy this matters for Bitcoin payments in e-commerce

The e-commerce platform market is dominated by Shopify (~$200B GMV), WooCommerce (~$200B), and Magento (~$100B). Bitcoin Lightning payments represent <0.1% of checkout volume across these platforms. Merchants are ready, buyers are there. The barrier is simply integration friction and trust.

Vendure is positioned differently: it's headless, open-source, and developer-first. Unlike WooCommerce or Shopify, Vendure gives full control over the payment stack integration. This is where a Bitcoin-native payment method actually makes sense, and currently there's no option for merchants or buyers to buy or sell products and services for bitcoin, P2P. Third parties are always there to get a cut.

With this plugin merchants can accept Lightning payments without running a node (optionally, when choosing Bootstrap in ShockWallet.app), managing channels, or trusting a third-party processor. Its integration with Lightning.pub makes this process much easier and intuitive for merchants willing to accept bitcoin P2P. The payment code is static, its called nOffer. Reuse the same code across orders and settlement happens via Nostr relays. No HTTP/HTTPS calls. It's simpler than BTCPay Server, cheaper than OpenNode.

As merchant

  • Signup to Shockwallet.app to het your multiplatform Bitcoin wallet
  • Optionally, install Lightning.pub node in your computer or VPS

As customer

  • Use any CLINK-aware wallets as Bitcoin Wallet
  • Find your nDebit to pay lightning invoices and activate subscriptions auto-renew

Market contextMarket context

  • Lightning Network capacity: 5,000 BTC ($325M) — growing 40% YoY
  • Global e-commerce: $6.3T (2024), projected $8T by 2027
  • Bitcoin payment processors: BitPay, BTCPay, Strike, OpenNode — all serve their niche
  • Headless commerce platforms: growing 25% CAGR as merchants ditch Shopify lock-in

The intersection of headless commerce + Bitcoin Lightning is underserved. Vendure has 8.3k GitHub stars and a growing plugin ecosystem. This plugin fills a gap that no other Vendure payment plugin addresses: Sovereign P2P Bitcoin Payments.

Security checksSecurity checks

The plugin has gone through security review: HMAC webhook auth, preimage verification, Nostr signature checks, BOLT11 amount validation. 59 passing tests. Open for audit.

Happy to answer questions or hear feedback from anyone running a Vendure store or considering Bitcoin payments.

v0.3.0 releasedv0.3.0 released

Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes).

npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink
GitHub: https://github.com/WoompaLoompa/vendure-clink

What's new in v0.3.0

  • Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
  • Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
  • Invoice expiry validation — already-expired invoices are refused
  • SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
  • Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
  • Atomic offer transitions — settlement/expiry only applies from pending state
  • Event kind 21001 + p-tag correlation checks on relay receipts

Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).

I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues
.

reply

I was not expecting this from npm just after few days

reply