payments: Bitnob adapter, and the KYB reality in both setups - #1013
Merged
Conversation
Adds @profullstack/sh1pt-payment-bitnob — African payouts over the rail the recipient actually uses: NIP in Nigeria, M-Pesa in Kenya and Tanzania, MTN MoMo in Ghana and Uganda, PayShap or EFT in South Africa. The reason to have both this and transfi is onboarding time, and the setup steps now say so instead of leaving it to be discovered. Bitnob's KYB review is typically 24-48 hours; TransFi's is 1-14 business days with production keys issued within 24h of verification. So Bitnob is the fast route to one African corridor in production, and TransFi is the breadth partner for the other 36. TransFi's steps also now name compliance@transfi.com, what UBOs must provide, and that the webhook secret arrives before KYB clears so the integration can be proven while verification runs. The guard that matters here is `requireEnvironment`. Bitnob serves sandbox and production from ONE base URL — the key alone decides which world you are in — so unlike every other adapter there is no host to eyeball and nothing in a request or response that reveals a sandbox key has been deployed to production. It would quote invented prices to real customers and look entirely healthy doing it. So the environment is required, never defaulted, checked before credentials are even read, and the error explains the consequence rather than just stating the rule, because a guard nobody understands gets deleted by the next person in a hurry. Sandbox keys are issued instantly and are for testing only. Production access needs KYB at both vendors; there is no shortcut at either. payout() validates and then refuses, as with transfi: the request shape is unverified and a fabricated transfer id would report money as sent when nothing left the account. 17 tests on this adapter, 111 across packages/payments. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KcjnyR2gpRBzWYGobUvuHT
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
ThreatCrush Security Scan49 finding(s) HIGH/CRITICAL: 1 | MEDIUM: 14 | LOW: 34
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
@profullstack/sh1pt-payment-bitnob— African payouts over the rail the recipient actually uses: NIP in Nigeria, M-Pesa in Kenya and Tanzania, MTN MoMo in Ghana and Uganda, PayShap or EFT in South Africa.Why both this and TransFi
Onboarding time, and the setup steps now say so rather than leaving it to be discovered mid-integration:
compliance@transfi.comSo Bitnob is the fast route to one African corridor in production; TransFi is the breadth partner for the other 36. TransFi's steps now also name the compliance address, what UBOs must provide, and that the webhook secret arrives before KYB clears — so the integration can be proven while verification runs.
The guard that matters
requireEnvironment. Bitnob serves sandbox and production from ONE base URL — the key alone decides which world you are in. Unlike every other adapter here, there is no host to eyeball and nothing in a request or response that reveals a sandbox key reached production. It would quote invented prices to real customers and look entirely healthy doing it.So the environment is:
Sandbox keys are issued instantly and are for testing only. Production access needs KYB at both vendors; there is no shortcut at either.
Consistent with the house pattern
payout()validates its arguments and then refuses, exactly astransfidoes: the request shape is unverified, and a fabricated transfer id would report money as sent when nothing left the account.The signing scheme is verified from Bitnob's published docs —
CLIENT_ID:TIMESTAMP:NONCE:PAYLOAD, HMAC-SHA256 keyed with the client secret, hex, across fourX-Auth-*headers — and pinned to exact bytes by a test, since a subtly wrong canonical string fails as a 401 that reads as a bad credential rather than as our bug.Testing
17 tests on this adapter, 111 across
packages/payments, typecheck clean.🤖 Generated with Claude Code
https://claude.ai/code/session_01KcjnyR2gpRBzWYGobUvuHT