TLDR
I wish to help on-board new merchants to the lightning network with minimal deployment friction.
To that end, I would like to sponsor the creation of super simple, static, single-page web app for creating invoices.
Background
I am in the process of coaching some local Bricks & Mortar merchants onto the lightning network. To ease the "mental transition" of using crypto, I'm highlighting the fiat auto-conversion option. Before the maxis get upset, remember small business often do their own reconciliations, so being able to download a CSV of transaction amounts and have them match with the bank is quite a benefit.
So - given this, and the fact that the operators will most certainly have zero Bitcoin experience, I'd like to initially recommend a custodial approach with a vendor who is reliable, easy to sign up with, and easy to use.
I tried out OpenNode and CoinCorner. CoinCorner was a difficult experience (to sign up as an organisation). OpenNode was straightforward and fast. The OpenNode API documentation is also extensive - vs CoinCorner which is non-existent. So I'm proposing to build with OpenNode.
Problem Statement
As it turns out, OpenNode don't have the exact solution I am looking for - which is this:
- Any member of staff can create invoices (and potentially, view previous invoices)
- They can do this safely on their own device without installing a native app
- They cannot MAKE payments (for refunds it's assumed they'd pay cash)
Proposed Solution
A static web app requiring ONLY the API OpenNode API key (and optionally, the merchant name). This could then be deployed using, say, Github Pages.
The OpenNode API keys come in 3 permission levels:
- Create Invoice
- Create Invoice & Read History
- Create Invoice & Read History & Make Payments
So either of the first two keys should be safe to use on a public, static website.
Benefits
- Really easy to deploy to a company subdomain (update DNS, clone repo, update CNAME, API Key, Merchant name, git push)
- Any staff member can go to the URL and make a payment, nothing to install
- No active server needed at backend, zero running costs
- Funds are safe
Risks of the proposed solution
- An attacker could create fake invoices or spam the service
- An attacker could read previous invoices (if the "readhistory" APIKey is chosen)
Summary
I believe the risks are well worth the benefits, to start the journey quickly and easily.
Before I post this as a job on Stacker News (and after I figure out how to do that anonymously) I wanted to check here in the community if perhaps such a solution already exists, or if there are any other significant risks with the proposal?