Checking who issued a zap receipt before adding it to a Nostr total
A post receives an event claiming a 21-satoshi Lightning zap. Matching the requested amount is insufficient: anyone can sign an event naming a post and a payment amount.
Identify the expected receipt signer
Read the recipient’s LNURL-pay endpoint and obtain its advertised Nostr key after confirming zap support. Compare it with the verified signer of the kind-9735 receipt. This fixture uses short key labels and a decoded invoice amount. The amounts agree in millisatoshis, but the signer check fails; the entry must not increase the displayed total.
const provider = { nostrPubkey: "service-A" };
const receipt = { kind: 9735, pubkey: "service-B", invoiceMsat: 21000n };
const request = { amountMsat: 21000n };
console.log(receipt.invoiceMsat === request.amountMsat);
console.log(receipt.pubkey === provider.nostrPubkey);
Validate the receipt against the signed request
Decode the BOLT11 invoice and the exact request string carried in description. Check the invoice description hash against that string, and compare invoice amount with the signed request amount when supplied. Verify beneficiary and event references before grouping by post. A zap receipt is an assertion from the recipient’s payment provider. For reconciling your own node balance, use your payment records.