Develop with Atum SDK

npm install @atumlabs/mppx-atum-escrow @atumlabs/payment-gateway-client mppx zod

import * as http from "node:http";
import { Mppx } from "mppx/server";
import {
  registerServer,
  buildChargeChallenge,
  corridorFromDefaults,
  type PaymentSubmitter,
} from "@atumlabs/mppx-atum-escrow/server";
import { PaymentGatewayClient } from "@atumlabs/payment-gateway-client";

// Example testnet gateway URL — see Endpoints for current hosts.
const gateway = new PaymentGatewayClient({ BASE: "https://payment-gw.production-testnet.atum.xyz" });

// A submitter forwards the verified PaymentRequest to the Payment Gateway to settle.
// Submit and return what the gateway said — do NOT poll for completion here.
// The gateway holds the connection for a short time. If settlement finishes in that time
// you get the result; if not, you get pending + payment_id, and that is the
// honest answer. Polling would hold the payer's HTTP request open (proxy timeouts)
// and hide the pending state that makes the payer's re-attempt safe.
const submitter: PaymentSubmitter = {
  async submit(request) {
    const res = await gateway.payments.submitPayment({ requestBody: request });
    return {
      payment_id: res.payment_id,
      status: res.status,
      transactions: res.transactions,
    };
  },
};

// What you receive and which sources you accept. `corridorFromDefaults` fetches the
// settlement vault, role, proxy, and verifier addresses from the gateway, so you never
// hardcode protocol contracts — only your own business config.
const corridor = await corridorFromDefaults(gateway, {
  destination: { network: "eip155:11142220", asset: "0x…USDT", account: "0x…merchant" },
  sources: [{ network: "eip155:421614", assets: ["0x…srcUSDT"] }],
  markupBps: 300, // source cap = fulfillment amount + 3%
  quoteDeadlineSeconds: 3,
  fulfillmentDeadlineSeconds: 600, // delivery deadline; too short and operators decline (DEADLINE_TOO_SHORT), see Deadlines
});

// `registerServer` takes only a submitter: it trusts the HMAC-bound challenge, so one
// registration serves every corridor you advertise.
const mppx = Mppx.create({
  realm: "api.example.com",
  secretKey: process.env.MPP_SECRET_KEY,
  methods: [registerServer({ submitter })],
});

// `buildChargeChallenge` turns the corridor + one source option into the atum-escrow
// challenge and stamps intentId — the purchase being paid for. Build it fresh **per
// request**: a challenge built once at module scope would stamp every payer with the
// same intentId, so a returning customer's second purchase would resolve onto their
// first (paid once, delivered twice).
const source = corridor.sources[0];

http.createServer(async (req, res) => {
  const purchaseId = req.url?.match(/^\/paid\/([^?]+)/)?.[1]; // one id per purchase, e.g. from the URL
  if (!purchaseId) {
    res.statusCode = 404;
    res.end();
    return;
  }

  const { request, meta } = buildChargeChallenge(
    corridor,
    { network: source.network, asset: source.assets[0] },
    "100000",
    { intentId: purchaseId },
  );
  const route = Mppx.toNodeListener((input) =>
    mppx.compose(["atum-escrow/charge", { ...request, meta }])(input),
  );

  const result = await route(req, res);
  if (result.status === 402) return; // mppx already wrote the 402 (challenge or still-settling)
  res.end(JSON.stringify({ message: "Here is your resource." }));
}).listen(4030);