SureLink Open Platform

Platform Overview & Onboarding ​

Welcome to the SureLink Payment Gateway open platform. SureLink provides an all-in-one fiat and cryptocurrency clearing and settlement gateway, enabling global merchants to connect seamlessly with liquidity providers and blockchain networks for secure, compliant, and cost-effective fund flows.

1. Core Architecture & Business Model ​

SureLink operates on a segregated matching and custody security model:

                    ┌────────────────────────┐
                    │ Merchant Business App  │
                    └───────────┬────────────┘
                                │ 1. Create/Query/Payout (HMAC API)
                                ▼
                    ┌────────────────────────┐
                    │    SureLink Gateway    │
                    └─────┬────────────┬─────┘
          2. Open Checkout│            │ 3. Match Order & Flow Proof
                          ▼            ▼
┌────────────────────────┐              ┌────────────────────────┐
│     End User / Buyer   │              │   Trader / Acceptor    │
│(Transfers fiat to card)│              │  (Provides liquidity)  │
└────────────────────────┘              └────────────────────────┘

1.1 Solution Matrix ​

ModuleFunctionalityBusiness Value
Fiat Pay-in (Deposit)Buyers purchase crypto via fiat transferThe merchant creates an order via API and redirects the user to the dedicated checkout URL (payUrl). The user transfers fiat to the matched trader, and funds are automatically released upon confirmation.
Fiat Payout (Withdrawal)Merchants disburse fiat to user bank accountsThe merchant requests a payout; the gateway freezes the merchant's crypto balance and assigns a trader to wire fiat directly to the recipient's bank account. Traders upload proof of payment for merchant review.
On-Chain Crypto (Deposit & Withdrawal)Native blockchain USDT operationsAutomatically provisions on-chain deposit addresses, listens for transaction confirmations, and automates hot-wallet crypto withdrawals.
Asynchronous WebhooksReal-time event notificationsDelivers sub-second notifications for order completion, cancellation, trader payment proofs, and disputes.

2. Four-Step Merchant Onboarding ​

mermaid
flowchart LR
    Step1["1. Register & KYC Verification"] --> Step2["2. Generate API Keys"]
    Step2 --> Step3["3. Configure IP Whitelist & Webhook"] --> Step4["4. Sandbox Testing & Go Live"]

Step 1: Registration & KYC / KYB Verification ​

  1. Access the SureLink Merchant Portal and register an administrator account.
  2. Complete enterprise KYC/KYB identity verification by submitting business licenses and authorized legal representative documents.
  3. Once approved, Pay-in and Payout permissions will be automatically activated.

Step 2: Generate API Key & Secret ​

  1. Log in to the Merchant Portal and navigate to "Developer Center" -> "API Keys".
  2. Create an API key pair:
    • API Key: Public identifier sent in the X-Api-Key request header.
    • API Secret: Symmetric signing secret for HMAC-SHA256 calculations. Displayed in full only once upon creation. Store it in a secure key vault.
  3. If compromised, you can revoke the old key and issue a new one immediately.

Step 3: Configure IP Whitelist & Webhook URL ​

  1. IP Whitelist:
    • For defense-in-depth, configure your production server outbound IP addresses in "Security Settings".
    • Requests from unlisted IPs are rejected with 403 Forbidden (IP_NOT_WHITELISTED).
  2. Webhook Callback URL:
    • Provide an HTTPS endpoint to receive order status updates and payment proofs.
    • Private/internal IPs (e.g., 127.0.0.1, 192.168.x.x) are rejected by built-in SSRF guards.

Step 4: Sandbox Testing & Production Launch ​

  1. Use the Sandbox environment to perform end-to-end integration tests, verify signature logic, and inspect Webhook handling.
  2. Switch Base URLs and API credentials to launch in production.

3. Environment & Protocol Specifications ​

3.1 Base URLs ​

EnvironmentBase URLDescription
Sandboxhttps://api-sandbox.surelink.ioTest environment for integration and mock payments
Productionhttps://api.surelink.ioLive production environment with real financial settlement

3.2 Protocol Standards ​

  • Transport: HTTPS (TLS 1.2+ required).
  • Encoding: UTF-8.
  • Payload Format: application/json for all request and response bodies.
  • Timestamps: Millisecond-level Unix timestamps (e.g., 1715000000000) or ISO 8601 UTC strings (e.g., 2026-10-11T08:30:00.000Z).
  • Monetary Precision:
    • Crypto assets (USDT): Sent as decimal strings with up to 6 decimal places (e.g., "100.500000").
    • Fiat amounts (CNY): Sent as decimal strings with exactly 2 decimal places (e.g., "725.50").