Just-in-time address fetching

POST {your_initiate_url}
Content-Type: application/json
X-Mesh-Timestamp: 1791230400
X-Mesh-Nonce: 6f1c2b7e-3a4d-4c8e-9f21-0b5d7e8a9c13
X-Mesh-Signature: 9b2f...e41a

{
  "userId": "UNIQUE_USER_ID",
  "networkId": "0ea47ee7-9d36-460e-a2d5-64cfa8a1dddd",
  "symbol": "XRP",
  "transactionId": "UNIQUE_TRANSACTION_ID"
}

const crypto = require('crypto')
const express = require('express')

const app = express()
const SECRET = process.env.MESH_JIT_SECRET // Replace: the secret you saved on the JIT Config page

const sha256Hex = (data) => crypto.createHash('sha256').update(data).digest('hex')
const hmacHex = (input) => crypto.createHmac('sha256', SECRET).update(input).digest('hex')
// RFC 3986: encodeURIComponent leaves ! ' ( ) * unencoded, Mesh doesn't
const rfc3986 = (s) => encodeURIComponent(s).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase())
const ordinal = (a, b) => (a < b ? -1 : a > b ? 1 : 0)

function verifyMeshRequest(req, rawBody) {
  const ts = req.get('X-Mesh-Timestamp')
  const nonce = req.get('X-Mesh-Nonce')
  const sig = req.get('X-Mesh-Signature')
  if (!ts || !nonce || !sig) return false

  // Replay protection: reject anything older or newer than 60 seconds
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(ts)) > 60) return false

  const url = new URL(req.originalUrl, 'https://placeholder')
  const sortedQuery = [...url.searchParams.entries()]
    .sort(([ka, va], [kb, vb]) => ordinal(ka, kb) || ordinal(va, vb))
    .map(([k, v]) => `${rfc3986(k)}=${rfc3986(v)}`)
    .join('&')

  const input = [
    'jit-request:v1',
    req.method,
    url.pathname,
    sortedQuery,
    sha256Hex(rawBody),
    ts,
    nonce,
  ].join('\n')

  const expected = Buffer.from(hmacHex(input))
  const received = Buffer.from(sig)
  return expected.length === received.length && crypto.timingSafeEqual(expected, received)
}

function sendSigned(res, httpStatus, body) {
  const json = JSON.stringify(body)
  const ts = Math.floor(Date.now() / 1000).toString()
  const sig = hmacHex(`jit-response:v1\n${sha256Hex(json)}\n${ts}`)
  res
    .status(httpStatus)
    .set({
      'Content-Type': 'application/json',
      'X-Mesh-Response-Timestamp': ts,
      'X-Mesh-Signature': sig,
    })
    .send(json)
}

function readyBody(userId, networkId, symbol, record) {
  return {
    status: 'ready',
    userId, // Must echo the request exactly
    networkId,
    symbol,
    address: record.address,
    ...(record.addressTag && { addressTag: record.addressTag }), // Required for memo chains
  }
}

// Initiate: respond immediately, never mint a second address
app.post('/mesh/jit/initiate', express.raw({ type: '*/*' }), async (req, res) => {
  if (!verifyMeshRequest(req, req.body)) return res.sendStatus(401)
  const { userId, networkId, symbol } = JSON.parse(req.body.toString())

  const record = await addressStore.get(userId, networkId, symbol) // Replace with your storage
  if (record?.address) return sendSigned(res, 200, readyBody(userId, networkId, symbol, record))

  await addressStore.startGenerationOnce(userId, networkId, symbol) // Replace: idempotent per triple
  return res.sendStatus(202) // No body or signature needed
})

// Status: read only, never triggers generation
app.get('/mesh/jit/status', async (req, res) => {
  if (!verifyMeshRequest(req, Buffer.alloc(0))) return res.sendStatus(401)
  const { userId, networkId, symbol } = req.query

  const record = await addressStore.get(userId, networkId, symbol) // Replace with your storage
  if (record?.address) return sendSigned(res, 200, readyBody(userId, networkId, symbol, record))
  if (record?.failed) return sendSigned(res, 200, { status: 'failed', reason: record.reason })
  return sendSigned(res, 200, { status: 'pending' })
})

curl --request POST \
  --url https://integration-api.meshconnect.com/api/v1/linktoken \
  --header 'Content-Type: application/json' \
  --header 'X-Client-Id: YOUR_CLIENT_ID' \ // Replace
  --header 'X-Client-Secret: YOUR_API_KEY' \ // Replace
  --data '
{
  "userId": "UNIQUE_USER_ID", // Replace
  "transferOptions": {
    "transactionId": "UNIQUE_TRANSACTION_ID", // Replace
    "transferType": "deposit",
    "toAddresses": [
      // Pre-generated: the most common ecosystems
      {
        "networkId": "03dee5da-7398-428f-9ec2-ab41bcb271da", // Bitcoin
        "symbol": "BTC",
        "address": "xxx" // Replace
      },
      {
        "networkId": "e3c7fdd8-b1fc-4e51-85ae-bb276e075611", // Ethereum
        "symbol": "USDC",
        "address": "xxx" // Replace
      },
      {
        "networkId": "aa883b03-120d-477c-a588-37c2afd3ca71", // Base
        "symbol": "USDC",
        "address": "xxx" // Replace
      },
      {
        "networkId": "0291810a-5947-424d-9a59-e88bb33e999d", // Solana
        "symbol": "USDC",
        "address": "xxx" // Replace
      },
      {
        "networkId": "0ea47ee7-9d36-460e-a2d5-64cfa8a1dddd", // XRP Ledger
        "symbol": "XRP",
        "address": "xxx", // Replace
        "addressTag": "xxx" // Replace: destination tag
      },
      // JIT: no address, fetched from your endpoints only if the user selects it
      {
        "networkId": "MESH_NETWORK_ID", // Replace with a long-tail network
        "symbol": "USDT" // Replace
      },
      {
        "networkId": "MESH_NETWORK_ID", // Replace with a long-tail network
        "symbol": "USDC" // Replace
      }
    ]
  }
}
'