HitPay Plugin for Claude Code
Zero-config SEA payment integration for Claude Code. Gives Claude deep knowledge of HitPay's payment gateway plus live API access — so when developers ask for payment integration, Claude scaffolds production-ready code with the right payment methods, webhook handling, and checkout flows.
What's Inside
Installation
Via Marketplace (recommended)
/plugin marketplace add hit-pay/claude-code-plugin
/plugin install hitpay@hitpay-plugins
Local Development
git clone https://github.com/hit-pay/claude-code-plugin.git hitpay-plugin
claude --plugin-dir ./hitpay-plugin
Setup
Set your HitPay API credentials:
export HITPAY_API_KEY=your_api_key_here
export HITPAY_SALT=your_webhook_salt_here
Get these from your HitPay Dashboard under Settings > Payment Gateway > API Keys.
Skills
Skills are auto-invoked when Claude detects relevant context in your conversation.
Commands
MCP Tools
When HITPAY_API_KEY is set, Claude can use these tools during development:
Read Operations
get_account_status— Check KYC and enabled providersget_balances— Current account balancesget_payment_request— Payment request detailslist_payment_requests— List payment requestslist_charges— List charges with filtersget_charge_detail— Charge detailslist_customers— List customersget_customer— Customer detailslist_invoices— List invoiceslist_subscription_plans— Subscription planslist_static_qrs— Static QR codesget_supported_qr_methods— Available QR methodsget_account_info— Account summary
Create Operations
create_payment_request— Create payment with checkout URLcreate_customer— Create customer recordcreate_invoice— Create invoicecreate_embedded_qr— Generate QR for payment collectioncreate_static_qr— Create permanent QR (POS)create_webhook_event— Register webhook URLcreate_recurring_billing— Set up subscription
Supported Markets
Security
This plugin follows a safe-by-default approach:
- Included: Read operations + payment creation (reversible/safe)
- Excluded from skills: Refunds, deletions, transfers, cancellations (destructive/financial operations)
- Webhook verification: All generated webhook handlers include HMAC-SHA256 signature checks
- API keys: Never exposed client-side in generated code
License
MIT