Astro Developer API

# 1. Create a user with your own reference
curl -X POST "$ASTRO_BASE/users" \
  -H "Authorization: Bearer $ASTRO_KEY" -H "Content-Type: application/json" \
  -d '{"reference":"cust_8812","first_name":"Ada","last_name":"Okafor"}'

# 2. Ask for a USDT (TRC20) deposit address
curl -X POST "$ASTRO_BASE/users/ref:cust_8812/addresses" \
  -H "Authorization: Bearer $ASTRO_KEY" -H "Content-Type: application/json" \
  -d '{"currency":"usdt","network":"trc20"}'

# 3. Read it until status is "ready"
curl "$ASTRO_BASE/users/ref:cust_8812/addresses/usdt" \
  -H "Authorization: Bearer $ASTRO_KEY"

const base = process.env.ASTRO_BASE;
const headers = { Authorization: `Bearer ${process.env.ASTRO_KEY}`, "Content-Type": "application/json" };
const call = async (method, path, body) => {
  const res = await fetch(base + path, { method, headers, body: body && JSON.stringify(body) });
  const json = await res.json();
  if (!res.ok) throw new Error(`${json.error.code}: ${json.error.message}`);
  return json.data;
};

await call("POST", "/users", { reference: "cust_8812", first_name: "Ada", last_name: "Okafor" });
await call("POST", "/users/ref:cust_8812/addresses", { currency: "usdt", network: "trc20" });

let addr;
do {
  await new Promise((r) => setTimeout(r, 3000));
  [addr] = await call("GET", "/users/ref:cust_8812/addresses/usdt");
} while (addr?.status !== "ready");
console.log(addr.address);

import os, time, requests

BASE = os.environ["ASTRO_BASE"]
S = requests.Session()
S.headers["Authorization"] = f"Bearer {os.environ['ASTRO_KEY']}"

def call(method, path, body=None):
    r = S.request(method, BASE + path, json=body, timeout=20)
    data = r.json()
    if not r.ok:
        raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
    return data["data"]

call("POST", "/users", {"reference": "cust_8812", "first_name": "Ada", "last_name": "Okafor"})
call("POST", "/users/ref:cust_8812/addresses", {"currency": "usdt", "network": "trc20"})

while True:
    time.sleep(3)
    addr = call("GET", "/users/ref:cust_8812/addresses/usdt")[0]
    if addr["status"] == "ready":
        print(addr["address"]); break

const crypto = require("crypto");

function verifyAstro(secret, rawBody, header, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec || !parts.v1) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const got = Buffer.from(parts.v1, "hex");
  return got.length === expected.length && crypto.timingSafeEqual(got, expected);
}

// Express: keep the raw body for this route
app.post("/astro/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyAstro(process.env.ASTRO_WEBHOOK_SECRET, req.body.toString("utf8"),
    req.get("X-Astro-Signature") || "");
  if (!ok) return res.sendStatus(400);
  const event = JSON.parse(req.body);
  // Skip if event.id was already handled, then do the work.
  res.sendStatus(200);
});

import hashlib, hmac, time

def verify_astro(secret: str, raw_body: bytes, header: str, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance or "v1" not in parts:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

function verify_astro(string $secret, string $rawBody, string $header, int $tolerance = 300): bool {
    $parts = [];
    foreach (explode(",", $header) as $p) {
        [$k, $v] = array_pad(explode("=", $p, 2), 2, null);
        $parts[trim($k)] = trim((string) $v);
    }
    $t = (int) ($parts["t"] ?? 0);
    if (!$t || abs(time() - $t) > $tolerance || empty($parts["v1"])) return false;
    $expected = hash_hmac("sha256", $t . "." . $rawBody, $secret);
    return hash_equals($expected, $parts["v1"]);
}

// $rawBody = file_get_contents("php://input");