docs(review): address Greptile review feedback across the stack

[rodrigopavezi]

Applies 16 of 18 Greptile review comments from PRs #88-95. Skipped:

• PR docs(nav): restructure navigation, remove legacy pages, retire Portal #88 forward-links comment (resolved by Phase B in docs(content): add use-case pages, Dashboard + Secure Payment tools pages #90 — pages now
  exist)
• PR docs(scripts): add Playwright screenshot capture scaffolding #91 lockfile exclusion (P2 opinion; team has chosen to gitignore)

PR #88

• getting-started.mdx: replaced the "API Key Generation" steps with the
  Client ID flow on the Dashboard.

PR #89

• secure-payment-supported-networks-and-currencies.mdx: qualified the
  cross-chain note — Tron payments are same-chain; Li.Fi swap-to-pay
  is EVM-source only.
• release-notes/request-api.mdx: distinguished the four "2026-Q1"
  Update blocks with topical sub-labels (Payouts, Tron, Accounting,
  Calldata).

PR #90

• docs.json: removed the duplicate tools/dashboard entry from the API
  Setup group. The Tools group in Resources is the canonical home.
• programmatic-payment-links.mdx: TS/Python/cURL switched from
  to per AGENTS.md style. Other Tabs blocks (EVM-vs-Tron
  variants) stay as Tabs since they are alternative content.
• programmatic-payment-links.mdx: fixed the timingSafeEqual signature
  check to compare decoded buffer lengths instead of raw hex string
  lengths.

PR #91

• package.json: dropped @playwright/test (only playwright is used).
• scripts/capture-screenshots.ts: switched waitUntil from "networkidle"
  to "load". Vite HMR keeps a persistent WebSocket open so networkidle
  always timed out against dev servers.

PR #92

• integration-tutorial.mdx: changed the webhook-section .env placeholder
  from <YOUR_API_KEY> to <YOUR_CLIENT_ID> for consistency.

PR #93

• secure-payments.mdx: rewrote the redirectUrl description to remove
  the self-contradiction ("redirected" vs "no auto-redirect").
• programmatic-payment-links.mdx: the "send back to your site" code
  example now captures the response and uses securePaymentUrl.

PR #94

• payee-destinations.mdx: accessPolicy sub-fields restructured from a
  Markdown table to with nested entries.
• compliance-gated-payments.mdx: "How it works" numbered list switched
  to with components.

PR #95

• multi-chain-checkout.mdx: "you decide of the destination" →
  "you decide on the destination" (grammar).
• batch-payouts.mdx: removed the duplicate "hosted" in the Mode 1
  description.
• welcome.mdx: dropped the SDK framing — the Dashboard and Secure
  Payment Page are no-code hosted tools, not SDK consumers.

[rodrigopavezi]

• docs(review): apply Tristan's two must-fix items from the final review #97
• docs(review): address Greptile review feedback across the stack #96 👈 (View in Graphite)
• docs(feedback): apply Tristan's revisions from RequestNetwork/request-api#806 #95
• docs(kyt): document KYT-screened payments as a use case + payee-destination field #94
• docs(secure-payments): document redirectUrl + redirectLabel #93
• docs(verify): fix broken cross-refs surfaced by mintlify broken-links #92
• docs(scripts): add Playwright screenshot capture scaffolding #91
• docs(content): add use-case pages, Dashboard + Secure Payment tools pages #90
• docs(content): refresh Tron coverage, batch-payment EVM scope, webhook 12-event list #89
• docs(nav): restructure navigation, remove legacy pages, retire Portal #88
• docs: fix broken links and clarify edge cases #87
• docs: add missing feature documentation for recent API changes #86
• docs: fix implementation discrepancies across API docs #85
• docs: remove beta banner and legacy SDK tab #78
• Remove AI-generated content warnings and update internal links #77
• docs(lifecycle): replace external image with local asset and remove AI-generated warning #76
• docs: remove AI-generated content warnings and simplify Request Scan page #75
• docs(resources): remove community page from navigation #74
• docs(supported-chains): add Tron network support and enhance currency documentation #73
• docs(supported-chains): streamline supported chains and currencies documentation #72
• docs(api-reference): add v2 endpoints overview and switch docs OpenAPI to v2-only spec Improve API Reference navigation by introducing a dedicated Endpoints Overview page in docs and wiring Mintlify OpenAPI rendering to a local v2-only spec. - add `api-re #71
• docs(authentication): simplify auth guide with API key vs Client ID methods and remove AI-generated content #70
• docs(fee-breakdowns): rewrite to focus on API response locations and reconciliation usage #69
• docs(protocol-fees): add protocol fees documentation and navigation #68
• docs(platform-fees): simplify configuration guide and remove AI-generated content warning #67
• docs(query-payments): rewrite with practical implementation focus and remove AI warning #66
• docs(query-requests): simplify and refactor query requests documentation for practical implementation #65
• docs(payment-detection): simplify content and remove AI warning #64
• docs(partial-payments): rewrite with step-by-step implementation guide and clarify API usage #63
• docs(standard-payments): remove AI warning, restructure content with step-by-step flow, and update API references #62
• docs(conversion-payments): rewrite with step-by-step implementation guide and remove AI-generated warning #61
• docs(payment-types): simplify overview and add payment type selection guidance #60
• docs(crypto-to-fiat): expand comprehensive guide with sandbox access, compliance flows, and implementation details #59
• docs(recurring-payments): rewrite with comprehensive workflow, security details, and practical implementation guide #58
• docs(batch-payments): add comprehensive implementation guide with examples, workflow diagrams, and demo videos #57
• docs(crosschain-payments): replace AI-generated content with comprehensive implementation guide #56
• docs(create-requests): rewrite with workflows, examples, and remove AI warning #55
• feat: add complete integration tutorial with Node.js backend and React frontend #54
• docs(getting-started): remove AI warning and refactor to focus on practical payment integration #53
• docs(api-portal): remove AI warning, add local screenshot, and update .gitignore #52
• docs: remove release notes section and streamline use cases to core features #51
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR applies 16 of 18 Greptile review items from PRs #88–95, covering credential naming (RN_API_KEY → RN_CLIENT_ID, x-api-key → x-client-id), component upgrades (<Tabs> → <CodeGroup>, numbered lists → <Steps>, Markdown tables → <Expandable>), and several correctness fixes.

• Credential rename is applied consistently across getting-started.mdx, integration-tutorial.mdx, create-requests.mdx, batch-payments.mdx, payouts.mdx, and the cURL registration snippets.
• Code correctness: timingSafeEqual now compares decoded buffer lengths instead of raw hex string lengths; crosschain-payments.mdx adds createPublicClient for waitForTransactionReceipt; the redirectUrl example now captures the response and exposes securePaymentUrl.
• Documentation quality: release-note labels disambiguated with topical sub-labels, expiresAt example corrected to 7 days, duplicate nav entry removed from docs.json, and multiple typos fixed.

Confidence Score: 4/5

Safe to merge after fixing the webhook signature example in getting-started.mdx.

The Getting Started webhook snippet now uses express.json() to parse the body, then computes an HMAC over JSON.stringify(req.body). Because the webhook provider signs raw bytes, the re-serialized form will not match and every webhook delivery will return 401. The correct pattern — shown in programmatic-payment-links.mdx — uses express.raw() so the raw bytes are hashed directly. All other changes in this PR (credential renames, component upgrades, timingSafeEqual fix, crosschain publicClient, nav dedup) are accurate and well-executed.

api-setup/getting-started.mdx — the webhook handler body-parsing middleware conflicts with its own HMAC verification logic.

Important Files Changed

Filename	Overview
api-setup/getting-started.mdx	Updated Client ID flow and added missing Express setup for webhook example, but the new express.json() body parser is incompatible with the existing JSON.stringify-based HMAC check.
use-cases/programmatic-payment-links.mdx	Correctly migrated Tabs to CodeGroup, fixed timingSafeEqual buffer-length comparison, and captured fetch response for securePaymentUrl.
api-features/crosschain-payments.mdx	Added createPublicClient import and usage for waitForTransactionReceipt; publicClient is correctly used in the approval transaction wait step.
api-features/payee-destinations.mdx	Converted accessPolicy sub-fields from Markdown table to Expandable + ParamField structure per AGENTS.md component guidelines.
api-setup/integration-tutorial.mdx	Renamed RN_API_KEY → RN_CLIENT_ID throughout, added eq import from drizzle-orm (used in two query clauses), fixed succesfully typo.
scripts/capture-screenshots.ts	Switched waitUntil from networkidle to load with explanatory comment; resolves Vite HMR persistent WebSocket timeout.
release-notes/request-api.mdx	Added topical sub-labels (Payouts, Tron, Accounting, Calldata) to the four 2026-Q1 Update blocks to disambiguate duplicate labels.
api-features/crypto-to-fiat-payments.mdx	Added /v2/ prefix to all payer endpoints, fixed Mermaid participant alias, corrected I**mportant formatting typo in Warning block.
docs.json	Removed duplicate tools/dashboard entry from the API Setup group; the Tools group in Resources remains the canonical location.
package.json	Removed @playwright/test dev dependency since the project uses the playwright package directly rather than the test runner.

Sequence Diagram

sequenceDiagram
participant Dev as Developer
participant GS as getting-started.mdx
participant PPL as programmatic-payment-links.mdx
participant WH as Webhook Handler
Dev->>GS: Copy webhook snippet
GS->>WH: app.use(express.json()) — body parsed as object
WH->>WH: JSON.stringify(req.body) HMAC re-serialized bytes
WH-->>Dev: Signature mismatch (401)
Dev->>PPL: Copy webhook snippet
PPL->>WH: "express.raw({ type: application/json }) — raw bytes preserved"
WH->>WH: createHmac.update(req.body) HMAC raw bytes
WH-->>Dev: Signature matches (200)

Loading

Comments Outside Diff (1)

1. api-setup/getting-started.mdx, line 171-186 (link)

   Webhook signature check will silently fail with express.json()

   This PR added app.use(express.json()) so that req.body is a parsed object rather than undefined, but the HMAC is then computed over JSON.stringify(req.body) — a re-serialized form that may differ from the raw bytes the server signed (different key order, whitespace, number encoding). The companion example in use-cases/programmatic-payment-links.mdx correctly uses express.raw({ type: "application/json" }) and hashes req.body directly as a Buffer. Following the Getting Started snippet will produce a signature that never matches, so every webhook will return 401.

_{Reviews (4): Last reviewed commit: "docs(review): finish /v2/ prefix consist..." | Re-trigger Greptile}

[MantisClone]

Reviewed the cumulative 40-PR stack against 6 source repos (request-api, request-auth-api, request-secure-payment, request-dashboard, request-token-list, request-infrastructure) plus the live preview at requestnetwork-docs-revamp-greptile-fixes.mintlify.app.

Two must-fix items below. Non-blocking observations will be filed as separate issues after deploy.

Must-fix #1 — SIWE example doesn't match server output

File: api-reference/wallet-authentication.mdx:35 (not in this PR's specific diff, so flagging here instead of inline)

The current message example shows a Chain ID: 1 line, omits an Expiration Time: line, and is missing the period after Sign in to Request Network. The actual server template at request-auth-api/src/auth/auth.service.ts:187-196 emits no Chain ID, always emits Expiration Time: (5 min after Issued At), and ends Sign in to Request Network. with a period.

Three edits:

• Drop the Chain ID: 1 line
• Add Expiration Time: <iso8601> (5 minutes after Issued At)
• Add the period: Sign in to Request Network.

Corrected example:

auth.request.network wants you to sign in with your Ethereum account:
0x6923831ACf5c327260D7ac7C9DfF5b1c3cB3C7D7
Sign in to Request Network.
URI: https://auth.request.network
Version: 1
Nonce: a1b2c3d4e5f6
Issued At: 2026-03-15T10:00:00.000Z
Expiration Time: 2026-03-15T10:05:00.000Z

Why it matters: signature verification is byte-exact. Anyone typing the example verbatim to test will get Invalid challenge and have no way to figure out why.

Must-fix #2 — Client ID Generation flow doesn't match Dashboard UI

See inline comment on api-setup/getting-started.mdx.

---

Already handled

• bassgeta's CHANGES_REQUESTED on #54 has been dismissed
• Code Sandbox link drop on api-setup/integration-tutorial.mdx:8 is in Rodrigo's queue (the workspaceId query parameter is user-scoped, so the link doesn't work for any non-author reader)

[MantisClone]

Must-fix items from prior review have been addressed in PR #97 (now sitting on top of this PR). SIWE message in wallet-authentication.mdx and Client ID Generation flow in getting-started.mdx both fixed correctly. Approving #96 to clear the review record — the stack is ready to ship.

[rodrigopavezi]

Merge activity

• May 12, 4:02 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 12, 5:23 PM UTC: Graphite rebased this pull request as part of a merge.
• May 12, 5:23 PM UTC: @rodrigopavezi merged this pull request with Graphite.