Developers

Build with BAM NFT

Drop a fully hosted NFT checkout into your own page, listen for signed webhooks, and let BAM handle minting, payments, PCI scope, and delivery. Two lines of HTML for the happy path — REST + webhooks when you need more.

Quickstart

Two lines of HTML

No npm install, no build step. Replace lnk_… with a CheckoutLink id from your dashboard.

Full guide

<!-- 1. Drop the loader on your page -->
<script async defer src="https://bamnft.com/embed/loader.js"></script>

<!-- 2. Drop a mount point per checkout -->
<div data-bam-checkout-link-id="lnk_…"></div>

<!-- 3. Listen for the buyer reaching success -->
<script>
  document.addEventListener('bam-checkout:complete', (e) => {
    window.location.href = '/thanks?order=' + e.detail.orderId;
  });
</script>

Start here

Embeddable Checkout

Drop a BAM checkout into your own page in two lines. iframe + signed webhooks + buyer-facing UI hosted on bamnft.com.

Read the guide

Webhooks

Signed (`bam-signature: t=,v1=`), Stripe-shape headers, 5-minute replay window, 30-day secret-rotation grace, ~24h retry envelope.

Read the guide

Security model

Per-merchant allowed-origins, per-session CSP frame-ancestors, unguessable session tokens, idempotent submit.

Read the guide

How it fits together

You drop the loader

A 4 KB script tag plus a div with a CheckoutLink id. The script mounts an iframe at bamnft.com/embed/… per matching div.

BAM hosts the checkout

Buyer fills email + wallet, picks an acquirer (Stripe / uPayWise), pays on the acquirer’s hosted page in a new tab. iframe polls for terminal state.

Your backend gets the webhook

Signed POST to your registered URL on `checkout.session.completed` (and `order.minted` when the mint lands). Idempotent via `bam-event-id`.

REST endpoints

All endpoints require a merchant API key (Authorization: Bearer bam_live_…). Mutations require the checkout:write scope. Idempotency-Key is honored on every POST.

Method	Path	Description
POST	/v1/checkout/links	Create a reusable checkout link (returns ready-to-paste snippet)
GET	/v1/checkout/links	List your links
PATCH	/v1/checkout/links/:id	Update price, currency, walletRequired, active, metadata
POST	/v1/checkout/sessions	Create a one-shot session for a dynamic cart
GET	/v1/checkout/sessions	List sessions (filter by `state`, `linkId`)
GET	/v1/checkout/sessions/:id	Get a session (token redacted)
POST	/v1/merchants/:id/allowed-origins	Register an origin allowed to embed checkout
POST	/v1/merchants/:id/webhook-endpoints	Register an outbound webhook endpoint (returns secret once)
POST	/v1/merchants/:id/webhook-endpoints/:id/rotate-secret	30-day grace window; worker emits `bam-signature-old` during the window

Tools you'll use

Need a hand?

Open the onboarding wizard for an interactive walk-through, or email help@bamnft.com — we typically reply within a business day.