Xpayr Postman Collection

---

XPayr Postman Collection

CI License: MIT

Official Postman collection and environments for exploring the XPayr Merchant API and testnet payment lifecycle.

Status: Official API workspace assets

Purpose

Give developers an importable, test-key-first workspace for the XPayr Merchant API.

Included

• Merchant API v1 request collection
• Safe environment template with no credentials
• Automated structural and secret-placeholder validation

Quick start

Import postman/xpayr_gateway_v1.postman_collection.json and postman/xpayr_gateway_v1.postman_environment.json into Postman.

Import

1. Import both JSON files from postman/.
2. Duplicate the environment locally and set bearer_token to an XPayr test key.
3. Keep base_url set to https://xpayr.com/api/v1.
4. Run Health, then create a testnet payment session before trying stateful requests.

Published assets intentionally contain no credentials. Run npm test after every collection update to validate schema, host, placeholders, and secret hygiene.

postman/xpayr_testnet_smoke.postman_collection.json is the restricted CI collection. It runs only health, testnet catalog, session creation, and session retrieval. GitHub Actions supplies credentials through the protected testnet-smoke environment. CI uses the repository's dependency-free allowlist runner instead of executing arbitrary Postman scripts, then passes the exact 0.001000 USDC Testnet session to a full-commit-pinned XPayr lifecycle action. That action completes the on-chain split and verifies reconciliation; Mainnet is hard-disabled, and uploaded evidence contains no credentials or resolved request headers.

Use an XPayr test key before live credentials. Never expose sk_test_*, sk_live_*, agent keys, webhook secrets, or wallet private keys in browser code or commits.

Documentation

• Developer Hub
• Merchant API documentation
• Testnet checkout guide
• Webhook signature guide

Security

Read SECURITY.md before reporting a vulnerability. Payment completion must be based on verified XPayr webhook/API state and canonical on-chain evidence, not browser callbacks alone.

License

MIT. See LICENSE.