Checkout on Robinhood Chain,
without ever asking for gas

The customer's signature is the payment. It binds the amount, the recipient, an expiry, and a nonce, so the merchant can submit it or not, but cannot change it.

How we know

USDG is a facet/diamond contract, so the honest way to ask whether it implements a function is getFacet(bytes4). Reproduce all of this with npm run verify:usdg.

robinhood (chain 4663)  USDG 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168
  getFacet(0xe3ee160e)  transferWithAuthorization      0x780d30b6...b01309  [OK]
  getFacet(0xef55bec6)  receiveWithAuthorization       0x780d30b6...b01309  [OK]
  getFacet(0xe94a0102)  authorizationState             0x780d30b6...b01309  [OK]
  getFacet(0xdeadbeef)  CONTROL: not a real function   not registered  [OK: control is unregistered]
  DOMAIN_SEPARATOR() live       0x7a3d7400b27830f4f91c2c16a082486d67c1befecaec2f53b33f1f35d5b62036
  reconstructed offline         0x7a3d7400b27830f4f91c2c16a082486d67c1befecaec2f53b33f1f35d5b62036
  name="Global Dollar" version="1"  [OK: match]
  decimals()                    6  [OK]

PASS: USDG exposes EIP-3009 and the EIP-712 domain reconstructs on every network.

The EIP-712 domain reconstructs offline to exactly the contract's own DOMAIN_SEPARATOR() on both networks, so the message hood-pay asks a customer to sign is the message the token will verify. The mainnet value is asserted as a fixed vector in the test suite.

Why EIP-3009 and not permit

EIP-2612 permit is also registered on USDG. hood-pay does not use it, because an allowance is the wrong shape for a checkout.

Quickstart

Node ≥ 20. viem is a peer dependency on the server; the browser bundle has none.

import express from 'express'
import { createPublicClient, createWalletClient, http } from 'viem'
import { privateKeyToAccount } from 'viem/accounts'
import { robinhood } from 'viem/chains'
import { HoodPayMerchant, SqliteStore, expressHoodPay } from '@three-ws/hood-pay/server'

const account = privateKeyToAccount(process.env.HOOD_PAY_RELAYER_KEY)
const transport = http('https://rpc.mainnet.chain.robinhood.com')

const merchant = new HoodPayMerchant({
  payTo: '0xYourReceivingAddress',
  network: 'robinhood',
  baseUrl: 'https://shop.example.com',
  store: new SqliteStore('./data/hood-pay.sqlite'),
  relayer: {
    reader: createPublicClient({ chain: robinhood, transport }),
    writer: createWalletClient({ account, chain: robinhood, transport }),
    address: account.address,
    chain: robinhood,
    maxAmountPerPayment: 1_000_000_000n,
  },
})

const app = express()
app.use(express.json())
app.use(expressHoodPay({ merchant, apiKey: process.env.HOOD_PAY_API_KEY }))
app.listen(3000)

<script src="https://unpkg.com/@three-ws/hood-pay/dist/browser/hood-pay.iife.js"></script>

<hood-pay-button
  intent-id="pi_2f1c..."
  api-base="https://shop.example.com"
  merchant-name="Example Shop"
  label="Pay 12.50 USDG"
  theme="auto"></hood-pay-button>

<script>
  document.querySelector('hood-pay-button')
    .addEventListener('hood-pay:settled', (event) => {
      console.log(event.detail.receipt.digest)
    })
</script>

const { intent, url } = await merchant.createPaymentLink({
  amount: '12.50',                 // USDG, exact
  description: 'One large widget',
  metadata: { orderId: 'A-1043' },
  idempotencyKey: 'order-A-1043',  // repeat-safe
  expiresInSeconds: 900,
})

console.log(url)  // https://shop.example.com/pay/pi_2f1c...

import { constructWebhookEvent } from '@three-ws/hood-pay/server'

// Mount BEFORE express.json(): the signature covers the exact bytes received.
app.post('/hooks/hood-pay', express.raw({ type: 'application/json' }), async (req, res) => {
  try {
    const event = await constructWebhookEvent({
      secret: process.env.HOOD_PAY_WEBHOOK_SECRET,
      rawBody: req.body.toString('utf8'),
      signature: req.header('Hood-Pay-Signature') ?? '',
      toleranceSeconds: 300,
    })
    if (event.type === 'payment_intent.succeeded') {
      await fulfil(event.data.intent.metadata.orderId, event.data.receipt)
    }
    res.sendStatus(200)
  } catch {
    res.sendStatus(400)
  }
})

Every state is designed

The widget renders exactly one design per state, and the type system refuses a state that has no design. No fake progress bars: each state reflects a real await.

Receipts anyone can check

A hood-pay receipt is not a claim the merchant makes. It points at on-chain facts, and anyone with an RPC URL can confirm them without asking the merchant, hood-pay, or an indexer.

import { verifyReceipt, formatVerification } from '@three-ws/hood-pay/verify'

const result = await verifyReceipt({ receipt })
console.log(formatVerification(result))

hood-pay or hood402

Same chain, same token, same settlement mechanism. Completely different product.

hood-pay depends on hood402 for the protocol-level pieces: the EIP-3009 ABI fragment and EIP-712 signature recovery. A parity test asserts the two packages' chain constants match field by field, so they cannot drift.

Install

npm install @three-ws/hood-pay viem