From a paid order
to your software’s result.

1. Define one fixed purchase

Use a dedicated USD Stripe Payment Link with quantity one and one fixed total. Disable quantity changes, discounts and variable tax totals for this integration. Save the link, its plink_ ID, your test/live mode, input description, sample and buyer terms in Outvend.

Keep sensitive or regulated material out of the initial pilot. The inputs go through Outvend to your software and are stored with the order.

2. Install the fulfillment endpoint

After saving the offer, Outvend shows your signing key once. Keep it in your software’s private environment. Your endpoint must verify the signature and retain results by job ID so retrying an order never repeats the underlying work.

POST https://yourapp.com/api/outvend
Content-Type: application/json
Idempotency-Key: <job UUID>
X-Outvend-Timestamp: <Unix seconds>
X-Outvend-Signature: <HMAC-SHA256>

{"version":"outvend-result-v1","jobId":"…","test":false,"input":"…"}

HTTP 200 application/json
{"version":"outvend-result-v1","jobId":"…","output":"The actual report…"}

The signature covers timestamp + "." + exact raw request body. Reject timestamps older than five minutes and compare signatures in constant time. Test requests must use a safe dry run. Endpoints must use HTTPS, public IPv4 DNS and no redirects, credentials or query parameters.

import { createOutvendFulfillment } from './fulfillment-sdk.mjs';

export default createOutvendFulfillment({
  key: process.env.OUTVEND_FULFILLMENT_KEY,
  // Implement with your database's unique job-ID constraint.
  runOnce: (jobId, input) => yourSoftware.runAndCache(jobId, input),
  runTest: input => yourSoftware.safePreview(input)
});

This helper verifies requests. Your software still implements the report and durable idempotency. A memory-only cache is insufficient across restarts.

3. Connect payment verification

After saving, copy the offer’s webhook URL into Stripe Workbench. Choose events from your account:

• checkout.session.completed
• checkout.session.async_payment_succeeded
• charge.refunded
• charge.dispute.created

Copy that webhook endpoint’s whsec_ signing secret into Outvend’s Connect payment verification form. Never enter a Stripe API secret key. Outvend encrypts the connection secrets and never returns them in account exports.

Payment is recognized only after a valid Stripe event matches the expected mode, Payment Link, fixed total, currency and order reference. A browser return URL does not unlock a result.

4. Test the complete purchase

1. Run Test delivery in your workspace and inspect the sample output.
2. Publish the test offer and open its buyer page.
3. Prepare a test order and copy the private recovery link.
4. Pay in Stripe test mode, return and check the result.
5. Repeat the webhook and verify one result; test failure/retry with the same job ID.
6. Refund the test payment and confirm private access is revoked.

Your workspace checklist distinguishes a saved signing secret, a passed endpoint dry run and an actually completed test order. None of them is labeled as real revenue. Live buyer payments require separate activation.

Change the offer without changing an order

Use Edit offer details on a draft or pause an active offer first. Correct the title, audience, description, input instructions, safe sample, terms or support email. Price, checkout and fulfillment connection stay fixed; create a new offer to change those. Existing orders retain the details they purchased. Changes to the sample or input instructions require a fresh delivery test before publishing.

A stale edit is rejected rather than overwriting a newer revision. An offer edited while a delivery test is running must be tested again.

Delivery and limits

Input up to32KB, text output up to64KB, maximum five delivery attempts. A lease prevents concurrent attempts; your endpoint’s idempotency protects against uncertain network outcomes. The seller can pause new orders while paid orders continue delivering.

A failed order is not retried just by refreshing its status. Buyers can choose Retry delivery, or sellers can retry from the workspace. Both reuse the same order and never initiate another payment. A busy lease or exhausted attempt limit is reported explicitly. Retries are request-driven in this pilot; no background delivery schedule or completion-time guarantee is promised.

Buyers receive a private recovery link, usable for seven days. They must keep it; v1 does not email it. The private receipt recovers the original checkout while payment is unconfirmed, then hides checkout once payment is verified. It includes the original offer title and a seller support link containing the order ID but not the private recovery token. Refunds and disputes revoke access. This access window does not promise data deletion. Sellers handle support and any duplicate-payment reconciliation. Outvend does not issue seller refunds automatically.

The workspace shows at most10 offers and the latest50 orders. The authenticated export API supports older order pages with the last row’s created_at and id as before/beforeId. Connection secrets and private buyer recovery tokens are excluded.