Nostr notes by WoompaLoompa

#CLINK plugin for #BTCpayServer finally approved and listed in ...

2026-08-31T15:18:18Z

#CLINK plugin for #BTCpayServer finally approved and listed in the plugin directory 🥳

Thank you btcpayserver (npub155m…dcvg) team for your relentless feedback, I’ve learned so much more in the past two months 🙏

https://stacker.news/items/1559179/r/06bc1a977d

Hitler tries a fake L2... ...

2026-08-20T19:55:53Z

Hitler tries a fake L2...

# @npub155m…dcvg #clink plugin v1.2.1 is out! ...

2026-08-18T09:17:37Z

# btcpayserver (npub155m…dcvg) #clink plugin v1.2.1 is out!

https://github.com/WoompaLoompa/btcpay-clink/releases#release-v1.2.1

New LNbits extension: #CLINK: Recurring #Lightning Payments, ...

2026-08-09T08:06:36Z

New LNbits extension: #CLINK: Recurring #Lightning Payments, #Subscriptions Auto-Renew & Funding Source for #LNbits.

Nostr-native Lightning for LNbits: publish a `noffer1...` and get paid over Nostr, pay other offers, and run **subscriptions with Lightning auto-renew** via CLINK debits. No Lightning.Pub required. A list of CLINK-aware apps is available at `clinkme.dev/apps.html`

- Offers (receive), Pay Offers (send)
- Subscriptions auto-renewal (day/week/month plans)
- Wallet debits with per-period budgets & rules
- CLINK (e.g. Lightning.pub) as funding source

Announcement: https://stacker.news/items/1543884/r/06bc1a977d

Demo: https://clink-lnbits.fly.dev/

Repo: https://github.com/WoompaLoompa/lnbits-clink

GPL-3.0, PRs, issues and any feedback welcome!

#bitcoin #nostr #asknostr

# v1.0.9 — Security Hardening (BOLT11 validation + guest-order ...

2026-08-02T08:16:42Z

# v1.0.9 — Security Hardening (BOLT11 validation + guest-order authorization)

### Summary
This release closes three security gaps identified in a plugin review: invoices were accepted without being validated against the order's network/amount/expiry, guest orders had no ownership check on the payment AJAX handlers, and `save_ndebit` trusted a client-supplied subscription ID.

Download and install from:

- GitHub https://github.com/WoompaLoompa/woo-clink/releases/tag/v1.0.9
- Wordpress https://wordpress.org/plugins/clink-gateway-for-woocommerce/

### Security fixes
- **Strict BOLT11 invoice validation** — the invoice is parsed server-side (bech32 checksum, HRP network, amount, expiry) before payment is confirmed. Invoices that are invalid, on the wrong network, for an amount that doesn't match the order total (within 1 sat), or that expire in under 60 seconds are rejected in the checkout UI.
- **Guest order-key authorization** — all four payment AJAX handlers (`check_payment`, `confirm_payment`, `mark_paid`, `save_ndebit`) now require the matching order key for guest orders; logged-in users must match the order's customer ID. Previously guests could confirm/mark any order.
- **Server-side subscription binding** — `save_ndebit` no longer accepts a client-supplied `subscription_id`; subscription IDs are derived server-side from the verified order.

### New
- **Network setting** (`mainnet` / `testnet` / `regtest`) added to the gateway configuration; invoices from a different network are rejected.
- Parsed invoice amount is recorded as `_clink_invoice_amount_sats` order meta.

### Install / Update
1. Upload/install `clink-gateway-for-woocommerce.zip` (attached) or update from the WordPress.org plugin page.
2. WordPress 5.8+ / WooCommerce 3.0+ / PHP 7.4+ (tested up to WP 7.0.2).
3. If you're on testnet or regtest, set **Bitcoin Network** in **WooCommerce → Settings → Payments → Lightning (CLINK)** so invoices are validated against the right chain.

# v1.0.2 update released in GH and npm ### Security Hardening - ...

2026-08-01T12:20:23Z

# v1.0.2 update released in GH and npm

### Security Hardening
- BOLT11 invoice validation: mainnet bc prefix, amount match, reasonable expiry; payment_hash extracted and stored on the session
- Webhook HMAC-SHA256 signature verification via CLINK_WEBHOOK_SECRET env var or webhookSecret option
- Webhook correlation: session existence, amount, and payment_hash matched before confirming; idempotent handling
- SSRF protection: relay URLs restricted to wss://, rejecting localhost/.local, private/loopback/CGNAT/link-local IPs, and unsafe IPv6 ranges
- nDebit validation: decode and validate debit pointers (type, pubkey, relay); requires safe relay and valid merchantPubkey
- k1 correlation key on debit requests (<subscription_id>:<count>)

### Added
- webhookSecret and merchantPubkey configuration options
- payment_hash on payment sessions; debit_pubkey/debit_relay on subscription data
- bolt11 and nostr-tools dependencies
- Expanded test suite (130 tests, 5 suites) with coverage thresholds met

npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
GitHub: https://github.com/WoompaLoompa/medusa-clink
.

# vendure-plugin-bitcoin-lightning-via-clink v0.3.0 released ...

2026-08-01T12:19:31Z

# vendure-plugin-bitcoin-lightning-via-clink v0.3.0 released

Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes). npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink | GitHub: https://github.com/WoompaLoompa/vendure-clink

### What's new in v0.3.0
- Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
- Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
- Invoice expiry validation — already-expired invoices are refused
- SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
- Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
- Atomic offer transitions — settlement/expiry only applies from pending state
- Event kind 21001 + p-tag correlation checks on relay receipts
- Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).

I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues

#buildstr #bitcoin #lightning #commerce #vendure #nostr #clink

Nostr event nevent1qqs8sy3auhxh6jvwtp8e48ld8fdecd9l4556ufn4dfrm6rmcx8cesuqzyqrtcx5h0kq0zf84g2hqg3s6h7k0hh5r59rmfyzlenyf7ymd4hcr54e8u4a

2026-07-28T09:31:52Z

MedusaJS is one of the fastest-growing open-source eCommerce frameworks, but despite its explosive growth in headless commerce, no Bitcoin Lightning module existed for MedusaJS. Until now. Built a MedusaJS module that enables Bitcoin Lightning payments for online stores using the CLINK protocol. Available via npm and GitHub.

Read more:
- https://stacker.news/items/1534561/r/06bc1a977d
- https://yakihonne.com/article/s/06bc1a977d@stacker.news/GyoUX3dJzUCaHQFyhrd1x

#bitcoin #commerce #ecommerce #lightning #clink #medusajs

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK ...

2026-07-28T09:19:14Z

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK
https://github.com/WoompaLoompa/medusa-clink

![](https://m.stacker.news/149911)

Built a MedusaJS plugin that enables Bitcoin Lightning payments for online stores using the CLINK protocol.
Available via [npm](https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink) and [GitHub](https://github.com/WoompaLoompa/medusa-clink).

**The gap:**
[MedusaJS](jttps://https://medusajs.com) is one of the fastest-growing open-source eCommerce frameworks ([35K+ stars](https://github.com/medusajs/medusa) on GitHub, claimed [$10B+ GMV](https://unsubbed.co/tools/medusa/) global, [~150K monthly](https://next-levels.de/en/medusa/) `npm` downloads). Despite explosive growth in headless commerce, no Bitcoin Lightning plugin existed for MedusaJS. Until now.

**Market context:**
- Bitcoin payments ecosystem: $8.7B in 2026, projected $53.65B by 2035 (22.4% CAGR) — MarkWide Research
- Lightning Network: $1.17B monthly volume, 266% YoY growth — River State of Lightning Report
- Lightning avg transaction size doubled to $223 (up from $118) — River
- Square opened Lightning to 4M US merchants with zero processing fees — Square
- 8/10 crypto holders hold for investment, only ~20% use for shopping — huge untapped merchant adoption potential

**What it does:**
- Accept Lightning payments on any MedusaJS store
- Self-custodial: merchant optionally runs their own Lightning.pub node, no third-party custody
- Instant settlement via Lightning Network
- QR code + one-click copy for invoices payments
- Auto currency conversion (CoinGecko, Kraken, Fixed rate, or manual)
- Subscriptions via nDebit recurring payments that activate automatic renewals.
- Dual confirmation: Webhook (primary) + Polling (backup)

**Why CLINK?**
[CLINK](https://stacker.news/items/1248472/r/06bc1a977d) (Common Lightning Interface for Nostr Keys) uses Nostr as transport layer with no web server required for your Lightning node if you chose Bootstrap on [ShockWallet.app](ShockWallet.app). Self-custodial by design when you opt-in running your [Lightning.pub](https://Lightning.pub) node. Ephemeral keys for payment requests = better privacy than traditional payment processors.

**Quick start:**
```
npm install medusa-plugin-bitcoin-lightning-via-clink
```

```typescript
// medusa-config.ts
{
resolve: "medusa-plugin-bitcoin-lightning-via-clink",
id: "clink",
options: {
noffer: "noffer1...", // Your CLINK offer
currencySource: "coingecko"
}
}
```

**Advantage:**
Traditional card payments cost merchants 2-3% per transaction. Lightning costs a fraction of a cent. Let's not even consider all telemetry and tracking that can be done by third parties on all your fiat payments, done and received. CLINK offers zero traceability without any traceable HTTP/HTTPS calls. For a small business processing thousands of transactions/month, the savings are material. Plus: no chargebacks, instant settlement, no waiting for batch processing, it just works, 24/7, 365 days a year non stop.

**Links:**
- npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
- GitHub: https://github.com/WoompaLoompa/medusa-clink
- Wiki: https://github.com/WoompaLoompa/medusa-clink/wiki

Feedback welcome. Happy to answer any questions.

https://stacker.news/items/1534561

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK ...

2026-07-28T09:14:03Z

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK
https://github.com/WoompaLoompa/medusa-clink

![](https://m.stacker.news/149911)

Built a MedusaJS plugin that enables Bitcoin Lightning payments for online stores using the CLINK protocol. Available via [npm](https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink) and [GitHub](https://github.com/WoompaLoompa/medusa-clink).

**The gap:**
[MedusaJS](jttps://https://medusajs.com) is one of the fastest-growing open-source eCommerce frameworks ([35K+ stars](https://github.com/medusajs/medusa) on GitHub, claimed [$10B+ GMV](https://unsubbed.co/tools/medusa/) global, [~150K monthly](https://next-levels.de/en/medusa/) `npm` downloads). Despite explosive growth in headless commerce, no Bitcoin Lightning plugin existed for MedusaJS. Until now.

**Market context:**
- Bitcoin payments ecosystem: $8.7B in 2026, projected $53.65B by 2035 (22.4% CAGR) — MarkWide Research
- Lightning Network: $1.17B monthly volume, 266% YoY growth — River State of Lightning Report
- Lightning avg transaction size doubled to $223 (up from $118) — River
- Square opened Lightning to 4M US merchants with zero processing fees — Square
- 8/10 crypto holders hold for investment, only ~20% use for shopping — huge untapped merchant adoption potential

**What it does:**
- Accept Lightning payments on any MedusaJS store
- Self-custodial: merchant optionally runs their own Lightning.pub node, no third-party custody
- Instant settlement via Lightning Network
- QR code + one-click copy for invoices payments
- Auto currency conversion (CoinGecko, Kraken, Fixed rate, or manual)
- Subscriptions via nDebit recurring payments that activate automatic renewals.
- Dual confirmation: Webhook (primary) + Polling (backup)

**Why CLINK?**
[CLINK](https://stacker.news/items/1248472/r/06bc1a977d) (Common Lightning Interface for Nostr Keys) uses Nostr as transport layer with no web server required for your Lightning node if you chose Bootstrap on [ShockWallet.app](ShockWallet.app). Self-custodial by design when you opt-in running your [Lightning.pub](https://Lightning.pub) node. Ephemeral keys for payment requests = better privacy than traditional payment processors.

**Quick start:**
```
npm install medusa-plugin-bitcoin-lightning-via-clink
```

```typescript
// medusa-config.ts
{
resolve: "medusa-plugin-bitcoin-lightning-via-clink",
id: "clink",
options: {
noffer: "noffer1...", // Your CLINK offer
currencySource: "coingecko"
}
}
```

**Advantage:**
Traditional card payments cost merchants 2-3% per transaction. Lightning costs a fraction of a cent. Let's not even consider all telemetry and tracking that can be done by third parties on all your fiat payments, done and received. CLINK offers zero traceability without any traceable HTTP/HTTPS calls. For a small business processing thousands of transactions/month, the savings are material. Plus: no chargebacks, instant settlement, no waiting for batch processing, it just works, 24/7, 365 days a year non stop.

**Links:**
- npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
- GitHub: https://github.com/WoompaLoompa/medusa-clink
- Wiki: https://github.com/WoompaLoompa/medusa-clink/wiki

Feedback welcome. Happy to answer any questions.

https://stacker.news/items/1534561

Cutomer can revocate sunscriptions in two ways: Plugin side: one ...

2026-07-13T10:10:38Z

In reply to nevent1q…kvkh
_________________________

Cutomer can revocate sunscriptions in two ways:

Plugin side: one click from WP site > My Account > Subscriptions > Cancel . It will delete the stored _clink_ndebit metadata. No future renewal orders will carry the authorization, so no further invoices get auto-paid.

Wallet side: since the ndebit is a signed authorization keyed to the customer's keys, they can also revoke it directly in their CLINK-compatible wallet (#ShockWallet, #LightningPub, ZEUS (npub1xnf…lpr5) , amethyst (npub142g…xrj0) , #Electrum, etc.) at any time. That kills it at the node level regardless of what the plugin stores.

Either one breaks the chain. Most customers will just hit the button in WooCommerce, but the wallet-side revocation exists too. Whatever is easier for the customer. On our side, we cannot do more than offering options for the customer to choose from.

Just dropped the #CLINK Payments Gateway for #Wordpress : ...

2026-07-13T05:04:18Z

Just dropped the #CLINK Payments Gateway for #Wordpress : Auto-renew subscriptions via Bitcoin Lightning, finally.

No third-party processor. No webhooks. No HTTP requests. No server for your node. Just a noffer, a Nostr relay, and the ndebit protocol doing the heavy lifting.

Merchants: generate a noffer1... in your CLINK wallet, paste it in WooCommerce, go.

Customers: scan a QR, pay, authorize auto-renewal once, never think about it again.

Recurring Lightning payments, fully self-sovereign.

Demo: https://woo-clink.wasmer.app

Code: https://github.com/WoompaLoompa/woo-clink

#Bitcoin #LightningNetwork #Nostr #WooCommerce #CLINK

Setup #CLINK plugin to enable #lightning payments Aupo-Renew for ...

2026-07-13T04:58:37Z

Setup #CLINK plugin to enable #lightning payments Aupo-Renew for your btcpayserver (npub155m…dcvg) 's Subscription plans.

Customers simply add a nDebit string to authorize future subscription plan payments

⚡ New: @nprofile…xhfg #CLINK Lightning plugin (Node ...

2026-07-13T04:25:41Z

⚡ New: btcpayserver (nprofile…xhfg) #CLINK Lightning plugin (Node Connection, Payments Gateway & Subscriptions Auto-Renew)

Accept Lightning payments via the CLINK protocol over Nostr. No web server required for your Lightning node. Enable Subscriptions Auto-Renew, no HTTP, all over #nostr.

→ Customers pay with ShockWallet, ZEUS, Amethyst, or any CLINK-compatible wallet → Subscription auto-pay via nDebit → Client-side invoice generation → Multiple relay support for redundancy

Install from the BTCPay Server plugin builder: https://plugin-builder.btcpayserver.org/public/plugins/clink

- Code: https://github.com/WoompaLoompa/btcpay-clink
- Docs: https://github.com/WoompaLoompa/btcpay-clink/wiki
- Announcement: https://stacker.news/items/1523268/r/06bc1a977d

#btcpayserver #BTCpay #lightning #nostr #clink #bitcoin

# ⚡️🤙 https://void.cat/d/W9GRqs6DbUsiqpJ3zXx7u1.webp

2023-09-23T05:50:02Z

# ⚡️🤙