You are adding BlindPay as the fiat offramp for my application. Anchorage Digital stays the custodian and signer for stablecoin balances (Atlas settlement, API custody operations, or Porto self-custody wallets). BlindPay only handles converting those stablecoins to fiat and paying out to a bank account.
Before writing code, read these sources and follow them over any prior knowledge:
- https://blindpay.com/docs/llms.txt (read the quickstarts, customers, bank accounts, quotes, payouts, and webhooks pages)
- The OpenAPI spec: curl https://api.blindpay.com/doc
- https://docs.anchorage.com/knowledge-base/api-reference/introduction for how our existing Anchorage integration authenticates and what it calls
Do the migration in this order:
1. Inventory my Anchorage usage from the codebase: every Anchorage transfer, withdrawal, Atlas settlement, or webhook call, plus every stored Anchorage ID (vault ID, wallet ID, transfer ID, settlement ID). Note which Anchorage flows stay as-is (custody, signing, on-chain settlement) and which ones today end in an offramp to fiat, since only the latter move to BlindPay. Confirm exact endpoint names and payloads in the Anchorage docs rather than assuming, and flag anything with no direct BlindPay equivalent. Produce a written inventory report before touching code.
2. Onboard the receiving parties as BlindPay customers: create a customer (re_) per payee with KYC or KYB data, add their payout bank account (ba_) for the correct rail (Pix, SPEI, SEPA, ACH, or wire), and store the resulting re_ and ba_ IDs against the same record that holds the Anchorage vault or wallet ID today.
3. If stablecoins are staying in an Anchorage Porto or vault wallet until payout time, register that wallet with BlindPay as an external wallet using the sign-message challenge flow and store the resulting bw_ ID, so BlindPay can recognize funds sent from it without taking custody itself.
4. Rebuild the offramp leg on BlindPay's two-step model: request a quote (qu_) for the payout amount and rail, then call POST /v1/instances/{instance_id}/payouts/evm to execute it as a payout (po_) before the quote's expires_at (about 5 minutes out). Replace whatever Anchorage transfer or withdrawal call currently ends a payout flow with this quote-then-execute pair, and confirm a payout reaches a terminal state end to end against a BlindPay development instance (USDB on testnets, KYC auto-approves) before moving on.
5. Add BlindPay webhook handling alongside whatever Anchorage webhook or polling logic exists today: verify the Svix signature (svix-id, svix-timestamp, svix-signature) against the raw request body with your whsec_ signing secret, dedupe on svix-id, and update payout status from the payout events. Use the $666.00 and $777.00 sentinel amounts in the development instance to confirm the forced-failed and forced-refunded paths are both handled.
6. Cut over per payout flow behind a feature flag: dual-run Anchorage's existing offramp path and the new BlindPay path side by side, compare outcomes on real payouts, and only remove the old offramp code once a full dual-run cycle settles cleanly on BlindPay and Anchorage still reconciles as the custody source of truth.
Constraints:
- Anchorage keeps custody and signing for anything not explicitly moved to BlindPay; do not build a second custody path.
- API keys for both providers stay server-side only.
- Amounts are integer minor units on both sides; no floating point money math anywhere in the payout path.
- Develop and test the new path against a BlindPay development instance before touching production keys.
Deliverables: the Anchorage usage inventory report, the customer and bank account onboarding script, the external wallet registration flow (if funds stay in Anchorage until payout), the quote-then-payout code path, webhook handlers with signature verification, and a cutover checklist per payout flow.