Near Getpay - Accept crypto payments with payment page using PingPay or HOT PAY

Accept crypto payments (NEAR, USDC, USDT) via a beautiful payment page with PingPay or HOT PAY integration.

Security Scan

The skill mostly implements a payment page for PingPay/HOT PAY as claimed, but there are inconsistencies and a few practices that could lead to accidental secret exposure or unexpected behavior (e.g., asking users to paste API keys in chat, using an SSH reverse tunnel, dynamic import of another skill).

Purpose & Capability

The code implements a hosted payment page, PingPay client, and an orchestrator for on-chain swaps/bridges; these align with the stated purpose. However the skill also exposes functions that call a separate 'near-intents' module to perform swaps/bridges (index.ts/payment-orchestrator), which is more than a simple static checkout page — this is plausible but broader than the minimal 'payment page' claim.

Instruction Scope

SKILL.md instructs the agent to ask users to "share" API keys in chat or add them to .env. Having the agent solicit secrets over chat is risky and not limited in the instructions. The runtime steps create a public tunnel (ssh to localhost.run) and run local code (npx/ts-node) — these are expected for exposing a page but mean a local service will be exposed externally. The skill also dynamically imports a '../near-intents' module and calls executeIntent, giving it the ability to run cross-skill/local code for on-chain actions.

Install Mechanism

There is no formal install spec in the registry (instruction-only), but the package includes package.json and expects npm install and npx/ts-node. All dependencies come from npm (common packages). No remote downloads or obscure URLs were found. However required binaries like 'ssh' and 'npx'/'ts-node' are used but not declared in the top-level registry metadata, which is inconsistent.

Credentials

The top-level registry metadata reported 'no required env vars', but skill.json and the code expect RECIPIENT_ADDRESS, PAYMENT_PROVIDER and (in practice) PINGPAY_API_KEY and HOTPAY item IDs; index.ts and usage text also reference NEAR_ACCOUNT_ID and NEAR_PRIVATE_KEY for on-chain payments. Sensitive credentials (PingPay API key, potentially NEAR private key) are required for full functionality; these are proportionate for payment operations but the skill's metadata and SKILL.md are inconsistent about which variables are required and the SKILL.md explicitly encourages pasting keys into chat, increasing exfiltration risk.

Persistence & Privilege

The skill does not request permanent platform-wide presence (always:false) and does not modify other skills' configurations. It does import a ../near-intents module if available which could invoke other skill logic, but the skill itself does not persist beyond running the local server and tunnel.

What to consider before installing

What to consider before installing: - Secrets: Do NOT paste API keys or private keys directly into chat with an agent. Prefer adding them to the skill's .env file on your machine and keep the file local (gitignored). The SKILL.md example encourages pasting keys into chat — avoid that. - Required binaries: The runtime spawns 'npx', 'ts-node' and an 'ssh' reverse tunnel (localhost.run). Make sure those binaries are present and that you're comfortable exposing a local port via an external tunnel. - Sensitive keys: The skill may require PINGPAY_API_KEY and (for automated on-chain payments) NEAR account credentials/private key. Only give the minimum-permission API key and consider creating a test key or account. - Public exposure: The start script opens a public URL to your local server. Run this only from a machine you control and consider using a paid/protected tunnel (ngrok/Cloudflare Tunnel) rather than an ephemeral ssh tunnel if you need production stability. - Cross-skill import: The orchestrator dynamically imports '../near-intents' and calls executeIntent for swaps/bridges. If you intend to use that functionality, inspect the near-intents code (and keep private keys secure). If you don't need on-chain automation, limit configuration to PingPay/HOT PAY checkout-only flows. - Verify claims: Inspect .env.example, server code, and PingPay/HOT PAY integration endpoints to confirm behavior matches your expectations before running. If you want to be cautious, run the server in an isolated environment (container or VM) and do an npm install offline review of dependencies. If you want, I can: (a) point out the exact lines where secrets are read or sent, (b) show a safe workflow for running this skill without exposing secrets to chat, or (c) produce a checklist for running it in a sandbox/container.

NEAR GetPay Skill

Accept crypto payments (NEAR, USDC, USDT) via a beautiful payment page with PingPay or HOT PAY integration.

🎯 What It Does

Creates a hosted payment page where people can pay you in crypto with just a few clicks:

1. Beautiful UI - Mobile-friendly payment page with preset amounts
2. Multi-token - Accept NEAR, USDC, or USDT
3. Dual provider - Works with PingPay or HOT PAY (or both)
4. Public URL - Exposes via localhost.run tunnel
5. First-time friendly - Setup wizard guides new users
6. Smart token selection - Once a token is selected, others are hidden to avoid confusion (great for HOT PAY where each token has a unique checkout link)

🎨 User Flow

PingPay Flow (default, best flow)

1. User selects token (NEAR, USDC, or USDT)
2. User enters amount or picks preset
3. Clicks "Pay Now"
4. Redirects to PingPay checkout with pre-filled amount

HOT PAY Flow

1. User selects token (only configured tokens shown)
2. Other tokens are hidden to avoid confusion
3. User enters amount or picks preset
4. Clicks "Pay Now"
5. Redirects to HOT PAY checkout link for that specific token and amount

🚀 Quick Start

1. Installation

cd ~/.openclaw/skills
# Clone or extract the skill
npm install

2. Choose Your Provider

You need either PingPay or HOT PAY (or both):

Option A: PingPay (recommended for beginners)

• Sign up at https://pingpay.io
• Set your NEAR wallet in Dashboard → Settings
• Get API key from Dashboard → Settings → API Keys
• Add to .env: PINGPAY_API_KEY=your_key_here

Option B: HOT PAY (for advanced users)

• Visit https://pay.hot-labs.org/admin/overview
• Create payment links for each token (NEAR, USDC, USDT)
• Set your NEAR wallet as recipient when creating each link
• Copy each item_id and add to .env

3. Configure

Copy .env.example to .env:

cp .env.example .env

Edit .env:

# Display name (actual recipient is set in PingPay/HOT PAY dashboard!)
RECIPIENT_ADDRESS=your-account.near

# Choose provider
PAYMENT_PROVIDER=pingpay  # or 'hotpay'

# PingPay config (if using PingPay)
PINGPAY_API_KEY=your_api_key_here

# HOT PAY config (if using HOT PAY)
HOTPAY_NEAR_ITEM_ID=your_near_item_id
HOTPAY_USDC_ITEM_ID=your_usdc_item_id
HOTPAY_USDT_ITEM_ID=your_usdt_item_id

4. Start Server

./start.sh

Or manually:

npx ts-node start-tunnel.ts

This will:

• Start Express server on port 3000
• Create public URL via localhost.run
• Display the shareable payment link

5. Share Your Link

Share the generated https://xxxxx.lhr.life URL to accept payments!

⚠️ Important Notes

Recipient Address Configuration

The recipient address (where payments go) is configured at the provider level, NOT in the .env file:

• PingPay: Set in your PingPay Dashboard → Settings → Wallet Address
• HOT PAY: Set when creating each payment link

The RECIPIENT_ADDRESS in .env is only for display on the payment page. To change where payments actually go, update your provider's dashboard settings.

Tunnel Domains

localhost.run generates random URLs that change each restart. For a permanent domain:

1. Sign up at https://admin.localhost.run/
2. Configure your custom domain
3. Update the tunnel command in start-tunnel.ts

Or use your own reverse proxy (Cloudflare Tunnel, ngrok paid, etc.)

📖 Usage in OpenClaw

When a user asks to accept payments:

User: "Create a payment page to accept USDT donations"

Agent:
1. Check if near-getpay skill is installed
2. Ask which provider they want (PingPay or HOT PAY)
3. Guide them through setup if not configured
4. Run: cd ~/.openclaw/skills/near-getpay && ./start.sh
5. Share the generated public URL

Example Conversation

User: I need to accept crypto payments

Agent: I'll set up a payment page for you using the GetPay skill.

First, do you have a PingPay or HOT PAY account?

User: No, what's easier?

Agent: PingPay is simpler. Here's what to do:

1. Sign up at https://pingpay.io
2. Add your NEAR wallet address in settings
3. Get an API key from Dashboard → API Keys
4. Share it with me (or add to .env yourself)

Let me know when you have the API key!

User: Got it: sk_test_abc123...

Agent: Perfect! Starting your payment server...

[runs start.sh]

✅ Your payment page is live:
https://abc123xyz.lhr.life

Share this link to accept NEAR, USDC, or USDT payments!

🛠️ File Structure

near-getpay/
├── SKILL.md              ← You are here
├── package.json
├── tsconfig.json
├── .env.example          ← Config template
├── .env                  ← Your config (gitignored)
├── start.sh              ← Quick start script
├── start-tunnel.ts       ← Server + tunnel launcher
├── server-simple.ts      ← Main payment server
└── scripts/
    ├── pingpay-client.ts
    └── payment-orchestrator.ts

🔧 Advanced Configuration

Custom Port

Edit .env:

PORT=8080

Custom Tunnel

Replace localhost.run in start-tunnel.ts:

// Option 1: ngrok
const tunnel = spawn('ngrok', ['http', PORT.toString()]);

// Option 2: Cloudflare Tunnel
const tunnel = spawn('cloudflared', ['tunnel', '--url', `http://localhost:${PORT}`]);

// Option 3: localtunnel (less reliable)
const tunnel = spawn('npx', ['localtunnel', '--port', PORT.toString()]);

Webhook Integration (HOT PAY only)

HOT PAY sends webhooks to /webhook/hotpay. To use:

1. Expose your server publicly (not localhost.run - needs stable URL)
2. Configure webhook URL in HOT PAY dashboard
3. Server logs payment confirmations automatically

🎨 Customization

Payment Amounts

Edit preset amounts in server-simple.ts:

tokens: [
  {
    symbol: 'NEAR',
    chain: 'NEAR',
    decimals: 24,
    presets: [0.5, 1, 5, 10]  // ← Change these
  },
  // ...
]

Branding

Update colors, fonts, text in the HTML template sections of server-simple.ts.

Add More Tokens

Add to the tokens array (requires provider support):

{
  symbol: 'ETH',
  chain: 'NEAR',
  decimals: 18,
  presets: [0.01, 0.05, 0.1, 0.5]
}

🐛 Troubleshooting

"No provider configured"

Visit http://localhost:3000/setup to see setup instructions.

"Permission denied (publickey)" (localhost.run)

Run: ssh-keygen -t rsa -b 2048 -f ~/.ssh/id_rsa -N ""

"Tunnel closed"

localhost.run tunnels timeout after inactivity. Restart the server.

"Token not configured" (HOT PAY)

You need to create a payment link for each token. Missing tokens won't appear on the payment page.

Provider returning errors

• PingPay: Check API key is valid and account is active
• HOT PAY: Verify item_ids match your created links

🔐 Security

• ✅ API keys stored in .env (gitignored)
• ✅ No private keys needed (payments go directly to provider)
• ✅ HTTPS via tunnel
• ✅ Webhook signature verification (HOT PAY)

Never commit .env to git!

📦 Sharing This Skill

As a Skill Package

# From the skill directory
openclaw skill pack

# Share the .skill file
# Users install with: openclaw skill install near-getpay.skill

Via GitHub

git init
git add .
git commit -m "Initial commit: NEAR GetPay skill"
git remote add origin https://github.com/yourusername/near-getpay.git
git push -u origin main

Users install with:

cd ~/.openclaw/skills
git clone https://github.com/yourusername/near-getpay.git
cd near-getpay
npm install

Via Clawhub

1. Visit https://clawhub.com
2. Upload the .skill package
3. Add description and tags
4. Publish!

🤝 Support

• Issues: GitHub Issues (if published)
• PingPay: https://pingpay.io/docs
• HOT PAY: https://pay.hot-labs.org/admin
• OpenClaw: https://docs.openclaw.ai

📝 License

MIT

---

Made for OpenClaw 🐾