Skip to main content

Release Notes

API​

Repricing (September 2026)​

The publicly marketed paid plan (tier id individual) moved from $99/month to $49/month and lost the "— Individual" suffix from its display name — it now shows simply as Agentic Commerce. Annual billing was dropped: no plan advertises an annual price.

  • Agentic Commerce — Business (tier id l402, previously $299/month) went contact-only (owner decision, 2026-09-02): it is de-listed from public pricing pages and from the pricing feeds — GET /api/stripe/pricing and GET /api/bitcoin/pricing now return only the publicly listed plans, so Business no longer appears in either response. POST /api/stripe/create-checkout-session, POST /api/bitcoin/create-subscription, /Checkout, and /BitcoinCheckout all reject a new Business subscription attempt with a 400 pointing to support@lightningenable.com. Existing Business subscribers, their renewals, and the admin endpoint (PUT /api/admin/merchants/{id}) are unaffected
  • Free Producer Sandbox (tier id free, $0, no card) is promoted as the default way to start: 3 endpoints, 200 challenges/month, 1,000 sats maximum per challenge
  • Tier ids and Merchant.PlanTier resolution are unchanged — existing accounts on any tier keep working exactly as before. Shipped as a code PR (lightning-enable#412) plus a documentation-only follow-up (lightning-enable#415) across the docs site, README, CLAUDE.md, and TERMS-OF-SERVICE.md

Plan Tier Consolidation (September 2026)​

Six plan tiers collapsed to three: free (Free Producer Sandbox), individual (Agentic Commerce — Individual), and l402 (Agentic Commerce — Business). The pilot, standalone, and standard (Kentico Commerce) tiers were removed after a production snapshot confirmed no account was on any of them. Prices are unchanged.

  • Retired tier ids still resolve, but cannot be selected — an account or an old link carrying standard, kenticocommerce, standalone, or standaloneapi resolves to individual, and pilot resolves to free, so nothing that worked stops working. Retired paid ids resolve to Individual rather than Free so an existing subscriber is never silently downgraded
  • planTier is now the normalized value on GET /api/merchant/me, GET /api/merchant/l402-status, and GET /api/merchant/subscription — a contract change. These three fields previously returned the raw stored column, so the same unset account was reported as pilot by two of them and standalone by the third. They now always return one of the three live tier ids. Update any client that string-matches a retired id
  • GET /api/stripe/pricing returns both paid plans — it previously returned exactly one, the retired Kentico tier that could not be purchased
  • Checkout endpoints accept the canonical l402 — POST /api/stripe/create-checkout-session and POST /api/bitcoin/create-subscription take individual, l402, or l402microtransactions, and reject a retired spelling with a 400 instead of failing later in the service
  • The refunds 403 no longer names a plan — it sends required_plan: null and action_required: "contact_support". No plan grants refunds; refundsEnabled is a per-account flag an operator sets on request, so the previous upgrade_plan sent customers to buy an upgrade that would not have helped
  • PUT /api/admin/merchants/{id} rejects an unrecognized or blank planTier with a 400 naming the accepted values, rather than persisting a typo. A retired spelling is still accepted and rewritten to the live tier
  • Display fixes — the /Success page after a Stripe checkout shows "Agentic Commerce — Business" instead of the raw l402microtransactions; welcome and payment emails no longer quote the retired Kentico plan or fall back to "Free" at $0.00 after a payment; /Checkout?plan=standalone preselects Individual instead of Business

Shipped across four stacked pull requests: #406 (core), #408 (write paths), #409 (display surfaces), #410 (documentation).

Documentation Accuracy Overhaul (July 2026)​

Full reconciliation audit of the docs site against the shipped product, fixing pages that had drifted from the code.

  • Corrected the documented webhook, refund, and payment API contracts to match actual response shapes and endpoints
  • Removed endpoints and features that never shipped (including a phantom Exchange Rates API) and fixed plan-matrix contradictions
  • Removed internal runbook content and any tutorial patterns that put API keys in browser-side code
  • Backfilled these release notes — the API section had not been updated since March 2026

L402 Protocol Fixes (June 2026)​

  • Caveat intersection — repeated macaroon caveats now intersect (monotonic narrowing) instead of last-write-wins, closing a scope-widening hole
  • Proxy macaroon scoping — proxy macaroon verification is bound to the merchant and path it was issued for
  • Spec-compliant identifier encoding — the macaroon identifier is encoded as raw bytes per the L402 spec, improving interoperability with other L402 tooling

Security Hardening (May–June 2026)​

Fixes from the May 2026 security audit, plus CI scanning.

  • Per-IP auth-failure throttle — repeated failed authentication attempts from one IP return 429 with a Retry-After header (defaults: 20 failures per 60-second window); also covers the Hangfire dashboard
  • Constant-time comparisons on all secret checks (API keys, admin key, webhook signatures)
  • Public checkout status endpoints trimmed to return only { status } — enumeration-safe, no side effects
  • Antiforgery enforcement on dashboard login and magic-link forms
  • HSTS header (staged, config-driven rollout; June 2026)
  • CodeQL, Semgrep, and gitleaks security scanning added to CI

Native L402 Server SDKs (May 2026)​

Native mode launched: monetize your API on your own domain — traffic never flows through Lightning Enable. See the Native Integration guide.

Dashboard: Smart Setup & Test-It Panel (May 2026)​

  • Smart Setup — paste an OpenAPI spec URL and the dashboard auto-detects your endpoints to create an L402 proxy
  • Test-It panel — live 402 preview per endpoint, so you can see exactly what agents receive before going live
  • Merged Pricing tab and self-service Regenerate API key button on Settings

Merchant CORS Auto-Allowlist & Canonical Shopify Identity (May 2026)​

  • Merchant-origin CORS auto-allowlist — merchant storefront domains are allowed automatically via the MerchantOrigins table; no manual CORS configuration per merchant
  • Canonical Shopify shop identity — the *.myshopify.com handle and primary domain are read from Shopify's own shop.json (never derived heuristically) on OAuth install, credential save, and an explicit dashboard refresh button; admin backfill and scope-probe diagnostics heal legacy rows

Premium Guides & L402 Tool APIs (May 2026)​

  • Premium guide catalog expanded and repriced; guides are L402-protected content endpoints — pay per guide with any L402 client (first shipped March 2026)
  • Tier 1 L402 tool APIs added to the registry

Shopify: Draft-Order Tax & Required Buyer Location (April 2026)​

  • Tax via Shopify Draft Orders — checkout creates a temporary draft order to get Shopify-calculated tax, which is included in the Lightning invoice total (requires the write_draft_orders scope)
  • X-Buyer-Location header is now required at Shopify checkout ({country}-{state}-{zip}, the buyer's location); the stored default-location fallback was removed
  • 30-day free trial on Agentic Commerce plans (card required, no charge until the trial ends)

v1.3.0 — Public L402 Test Endpoint (March 2026)​

  • Public test endpoint — GET https://api.lightningenable.com/l402/test/ping returns a 402 with a 1-sat invoice, no API key or signup required
  • Pay the invoice, retry with Authorization: L402 <macaroon>:<preimage>, get a 200 — full L402 round-trip in two curl commands
  • Alby Hub officially verified as L402-compatible

Shopify L402 Integration (March 2026)​

AI agents can browse a Shopify catalog, pay via Lightning, and create real Shopify orders — L402 cryptographic proof is the payment verification, no webhook dependency.

  • Public store endpoints: catalog → checkout (402 + Lightning invoice) → claim with Authorization: L402 {macaroon}:{preimage} + shipping address
  • Shopify OAuth app install from the dashboard, with manual token entry preserved as an advanced fallback
  • Claim tokens allow a configurable window (default 30 days) to provide shipping details after payment; expired unclaimed orders are auto-purged
  • Active Shopify stores are auto-registered in the L402 API registry for agent discovery
  • See the Shopify Commerce docs

v1.2.0 — L402 Producer API (March 2026)​

Agents can now earn, not just spend. The L402 Producer API enables Agentic Commerce subscribers to create L402 payment challenges and verify payments — powering agent-to-agent commerce where AI agents autonomously buy and sell services.

New Features​

  • L402 Producer API — Two new endpoints (POST /api/l402/challenges, POST /api/l402/challenges/verify) let merchants programmatically create L402 payment challenges and verify L402 tokens
  • Challenge idempotency — Same resource + price from the same client within 60 seconds returns the same invoice, preventing duplicate charges on retries
  • Two new MCP tools — create_l402_challenge and verify_l402_payment bring producer capabilities directly to AI agents via MCP

Documentation​

Strike Payment Provider (February 2026)​

Multi-provider settlement abstraction: merchants choose Strike or OpenNode as their payment provider. Lightning Enable does not hold funds — the configured provider facilitates custody and settlement.

  • Strike is the default provider on the hosted service (PaymentProvider:Default); each merchant can override per-account
  • Strike returns the preimage on outgoing payments, which L402 requires — making it the recommended provider for L402 workloads
  • Strike webhooks supported (thin payloads — the API fetches full entity details after receipt)
  • Multi-currency support via Strike (USD, EUR, GBP, AUD, BTC, USDT)

v1.1.0 — Security Audit & Quality Hardening (February 2026)​

Comprehensive security audit and code quality pass across the entire API surface. Added 244 new tests, bringing total coverage from 407 to 651 tests.

Security Hardening (7 Critical + 13 High Priority)​

Critical fixes:

  • SSRF protection on webhook callback URLs and proxy target URLs — block internal/private network ranges
  • Webhook signature verification — constant-time HMAC comparison to prevent timing attacks
  • L402 amount binding — macaroon caveats now bind to the invoiced amount, preventing underpayment exploits
  • Subscription enforcement — active Stripe subscription required for all authenticated API operations
  • Error sanitization — internal exception details, stack traces, and infrastructure information no longer leak in API responses
  • API key hashing — merchant API keys stored as one-way hashes for improved credential security
  • Webhook replay protection — timestamp validation rejects stale webhook deliveries

High priority fixes:

  • Rate limiting on authentication, invoice creation, and webhook endpoints
  • Idempotency keys on all OpenNode charge creation calls to prevent duplicate invoices
  • Request size limits on all endpoints accepting request bodies
  • Input validation on all merchant-supplied URLs (scheme, length, format)
  • Correlation ID propagation via X-Correlation-Id header for end-to-end request tracing
  • Webhook delivery queue hardening with dead-letter handling and bounded retries
  • L402 macaroon expiry enforcement and nonce replay protection
  • Proxy target URL allowlist validation against merchant-registered domains
  • Merchant-scoped database query enforcement across all repository methods
  • Stripe webhook signature verification on all subscription lifecycle events
  • OpenNode API key validation on merchant registration
  • Secure cache headers on all API responses
  • Admin endpoint authentication audit and header validation

API Improvements (10 Medium Priority)​

  • OpenAPI annotations on all endpoints with response type documentation
  • Cancellation token propagation through all async controller actions and service methods
  • DTO validation attributes on all request models (required fields, range constraints, URL format)
  • Structured logging with Serilog semantic properties across all services
  • Consistent error response format using ProblemDetails (RFC 9457)
  • Health check endpoint expanded with dependency status (database, OpenNode, Stripe)
  • Webhook delivery status tracking with queryable history per merchant
  • Rate-limited (429) responses include a retryAfter hint (seconds) in the JSON error body
  • Request/response logging middleware with PII redaction
  • Graceful shutdown handling for in-flight webhook deliveries and background jobs

Code Quality (5 Low Priority)​

  • Dead code removal across controllers, services, and middleware
  • Consistent async/await patterns — eliminated fire-and-forget calls
  • Nullable reference type annotations on all public API surfaces
  • Standardized exception hierarchy with domain-specific exception types
  • Code style enforcement via .editorconfig and analyzer rules

Test Coverage​

  • 244 new tests added (407 to 651 total)
  • Security-focused tests: SSRF blocking, signature verification, replay protection, rate limiting
  • Integration tests for full webhook delivery pipeline
  • L402 protocol tests covering challenge, payment, and verification flows
  • Subscription enforcement tests across all plan tiers
  • Edge case coverage for concurrent requests, timeout handling, and malformed input

MCP Server​

Tool Consolidation — Lite/Standard/Full Profiles (MCP 2.0.0, September 2026)​

The one-tool-per-operation surface is replaced by three selectable profiles, set with LIGHTNING_ENABLE_TOOL_PROFILE: lite (pay_invoice, access_l402_resource, get_balance, budget, receipts, setup_wallet), standard (the new default — adds pay_l402_challenge, test_l402_payment, create_invoice, check_invoice_status, verify_confirmation_code, discover_api, create_lightning_enable_account, wallet_ops, l402_producer, agent_services), and full (standard plus every pre-consolidation tool name as a deprecated alias, for prompts and integrations written before this change).

  • New consolidated, action-based tools: budget (action="status"|"tighten", replaces get_budget_status + configure_budget), receipts (source="durable"|"session", replaces get_receipts + get_payment_history), wallet_ops (action="price"|"exchange"|"send_onchain", replaces get_btc_price + exchange_currency + send_onchain), l402_producer (action="create"|"verify"|"configure_receive"|"status"|"create_proxy"|"add_endpoint"|"publish"|"list_challenges", replaces create_l402_challenge + verify_l402_payment and adds six new producer-setup actions), and agent_services (action="discover"|"request"|"settle"|"publish"|"unpublish"|"attest"|"reputation", replaces all seven ASA tools).
  • New tool: setup_wallet — configures ~/.lightning-enable/config.json (wallet credential, spend ceiling) without hand-editing JSON.
  • All 18 pre-consolidation tool names (the 16 above plus the pre-existing check_wallet_balance/get_all_balances/confirm_payment aliases from v1.17.0) remain callable as deprecated aliases under LIGHTNING_ENABLE_TOOL_PROFILE=full, scheduled for removal in v3.0.0.
  • Out-of-band confirmation gains a confirmation.channel config option (stderr default, refuse, webhook, file), and LIGHTNING_ENABLE_HOSTED=1 defaults a non-TTY process to refuse instead of stderr.
  • Sats-native budget keys — limits.maxPerPaymentSats / limits.maxPerSessionSats and tiers.autoApproveSats — sit alongside the existing USD-denominated ones for operators who'd rather not depend on the live BTC price feed for their ceiling.
  • The durable receipt log is now also exposed as an MCP Resource at lightning-enable://receipts.
  • See the MCP Complete Guide for the full current tool list and the deprecated alias table.

v1.24.0 – v1.24.1 — Modern MPP "Payment" Scheme + Discovery Fixes (August 2026)​

  • MPP draft-00 client support, both ports: modern Payment challenges (draft-httpauth-payment-00) are parsed and answered with the single-use Authorization: Payment <base64url(JSON)> credential, with client-side safety checks (expiry, intent: charge, sat currency, amount-vs-invoice agreement). access_l402_resource surfaces the server's Payment-Receipt; pay_l402_challenge accepts a raw challenge via challengeHeader / challenge_header.
  • discover_api probe alignment (v1.24.1): manifests are also probed at /.well-known/l402.json, and protocol signposts are no longer mistaken for manifests.
  • NWC multi-relay failover on connect (.NET).

v1.17.0 – v1.23.x — Tool Consolidation, Marketplace, Receipts (July–August 2026)​

  • Renamed/merged tools (v1.17.0): confirm_payment → verify_confirmation_code (it only ever verified a code — it never moved money), and check_wallet_balance + get_all_balances → get_balance (a single tool returning the superset of both). Old names keep working as hidden deprecated aliases until v2.0.0; responses carry a deprecated marker.
  • unpublish_agent_capability joined the ASA surface (take a listing down: retires the L402 proxy, publishes a NIP-09 deletion + status=removed replacement). Canonical inventory since then: 26 tools = 17 out-of-the-box + 9 producer/ASA — see the MCP Complete Guide.
  • get_receipts — durable local receipt log for payments made through the server.
  • Removed the legacy L402_MAX_SATS_PER_REQUEST / L402_MAX_SATS_PER_SESSION environment variables; operator limits live in ~/.lightning-enable/config.json (USD-denominated), with configure_budget tighten-only at runtime.
  • NWC hardening: multi-relay connection strings (Alby Hub), SSRF connect guards, encryption auto-detect refinements.

v1.15.0 — Self-Serve Signup (July 2026)​

  • create_lightning_enable_account — self-bootstrapping signup: pays the ~100-sat L402 Fast Lane challenge (POST /api/signup/l402) with the connected wallet, returns a merchant API key with a 30-day trial, and writes it to ~/.lightning-enable/config.json so the producer/ASA tools unlock on next restart. No card, no browser.

v1.12.13 — Destination-Bound Confirmation Codes (June 2026)​

Security release — update both packages.

  • Confirmation codes are now bound to the payment destination, in addition to the amount and tool: the BOLT11 invoice (pay_invoice, pay_l402_challenge), the resource URL (access_l402_resource), the on-chain address (send_onchain), and the settlement endpoint (settle_agent_service, Python).
  • Closes an anti-redirect hole: previously a prompt-injected agent could obtain a code for a benign payment, then re-call the same tool at the same amount with a different destination. Destination mismatch now rejects without consuming the code, so the legitimate retry still works.
  • Applies to both the .NET and Python packages.

v1.12.12 — Python Funds-Safety Parity (June 2026)​

Brings the Python package in line with the .NET out-of-band confirmation that shipped in v1.12.10.

  • Out-of-band confirmation now in Python too. Above-threshold payments (pay_invoice, access_l402_resource, pay_l402_challenge) print the confirmation code to the server console/stderr only — never in a tool result — so a prompt-injected agent can't read its own code and self-approve. Before this release the Python package still accepted an agent-supplied confirmation flag.
  • send_onchain always confirms and fails closed in Python (parity with .NET): no budget service, or any budget-check error, refuses the send.
  • Confirmation parameter unified across both packages — .NET uses confirmationNonce, Python uses confirmation_nonce (same concept, each language's casing).
  • The legacy in-process budget manager now fails closed above the auto-approve floor instead of allowing a self-confirm.

v1.12.11 — Python Packaging Fix (June 2026)​

  • secp256k1 is now an optional dependency. pip install lightning-enable-mcp works on every platform, including Windows, with no build toolchain.
  • Nostr Wallet Connect (NWC) wallets need the optional extra: pip install lightning-enable-mcp[nwc]. Using an NWC wallet without it raises a clear error telling you to install it. Other wallet types (LND, Strike, OpenNode) don't need the extra.
  • The .NET package is unaffected — it uses managed crypto.

v1.12.10 — Funds-Safety Hardening (June 2026)​

Hardens the agent payment path so a prompt-injected agent can't approve its own large payments.

  • Out-of-band confirmation (.NET in this release; Python parity in v1.12.12). When a payment exceeds the auto-approve threshold, the server prints a confirmation code to its console / stderr — visible to the human operator and never returned in a tool result. The agent must ask the human for the code, then re-call the original payment tool with its confirmation-nonce parameter (confirmationNonce in .NET, confirmation_nonce in Python) to proceed. (The separate confirm_payment tool only verifies a code — it does not execute the payment.) Applies to pay_invoice, access_l402_resource, and pay_l402_challenge. This assumes the AI runtime can't read the server's stderr/logs; for agents that share a shell/host with the server, run it where the agent can't read its stderr.
  • send_onchain always requires confirmation (on-chain payments are irreversible), even for small amounts, and fails closed if the budget service is unavailable.
  • Confirmation codes are bound to the exact amount AND tool they approved — no cross-tool or cross-amount reuse.
  • configure_budget added to the .NET server (previously Python-only) and is tighten-only in both packages: an agent can lower its per-request / per-session caps at runtime but can never raise them above the operator's ~/.lightning-enable/config.json limits.
  • Budget checks fail closed if the BTC price feed is unavailable (3 price sources, no stale fallback).
  • The NWC response preimage is no longer logged.

v1.12.2 — Critical: Payment Confirmation Fix (April 2026)​

Severity: Critical — affects all .NET MCP clients since v1.6.0

Problem: When a client reports MCP elicitation capability (as Claude Code does) but elicitation doesn't actually work, the payment confirmation flow returned "Payment cancelled by user" with no nonce and no recovery path. Any payment above the auto-approve threshold was permanently blocked.

Fix: Always fall back to nonce-based confirmation when elicitation fails, regardless of reported client capabilities. Affected tools: pay_invoice, access_l402_resource, pay_l402_challenge.

Update immediately:

# .NET global tool
dotnet tool update -g LightningEnable.Mcp

Affected versions: v1.6.0 through v1.12.1 (all deprecated on NuGet). Python package was never affected.

v1.11.2 — Version Bump (March 2026)​

  • Version bump for CI pipeline alignment; no functional changes

v1.11.1 — L402 HTTP Client Fix (March 2026)​

  • Fixed gzip decompression issue in the L402 HTTP client by sending Accept-Encoding: identity, preventing decompression errors on some servers

v1.11.0 — NIP-44 v2 Outgoing Encryption (March 2026)​

  • NWC outgoing requests now encrypted with NIP-44 v2 (Alby Hub compatibility)
  • NIP-47 encryption tag support for improved NWC interoperability

v1.10.1 — Docker Image Update (March 2026)​

  • Updated Docker base image; no functional changes

v1.10.0 — NIP-44 v2 Incoming Decryption (March 2026)​

  • Auto-detects NIP-04 vs NIP-44 v2 encryption on incoming NWC responses
  • No configuration required — works transparently with all supported NWC wallets

v1.9.0 — Producer Tools (March 2026)​

  • create_l402_challenge — AI agents can now sell services: create a Lightning invoice + macaroon to present to other agents or users as a 402 challenge
  • verify_l402_payment — Verify an L402 token (macaroon + preimage) to confirm payment before granting access
  • Both tools require an Agentic Commerce subscription (from $99/mo)

v1.8.0 — LND Wallet Support (February 2026)​

  • Added LND REST API wallet backend for self-hosted nodes
  • Configure with LND_REST_HOST and LND_MACAROON_HEX env vars
  • Full L402 preimage support via LND

v1.7.0 — discover_api Tool (February 2026)​

  • discover_api — Search the L402 API registry by keyword/category, or fetch a specific API's manifest from a URL
  • Budget-aware annotations show how many calls you can afford at the current BTC price

v1.6.0 — License Removed, All Consumer Tools Free (February 2026)​

  • License requirement removed — all 15 consumer tools are now free, no Lightning payment or subscription required
  • Added confirm_payment tool for explicit payment confirmation before execution
  • The 6,000-sat license purchase from v1.5.0 is no longer needed; existing licenses are ignored

v1.5.2 — Version Display Fix (February 2026)​

  • Assembly version now matches package version for accurate startup display
  • Includes all v1.5.1 fixes below

v1.5.1 — Critical Bug Fix (February 2026)​

Severity: Critical — affects all payment confirmations

Problem: The confirm_payment tool was consuming the payment nonce before pay_invoice could use it. This caused every confirmed payment to fail with:

Invalid, expired, or already-used confirmation nonce

Root Cause: Both confirm_payment and pay_invoice called ValidateAndConsumeConfirmation(), which removes the nonce from memory. Since confirm_payment runs first (to get user approval), it consumed the nonce, leaving nothing for pay_invoice to validate against.

Fix: confirm_payment now uses a read-only ValidateConfirmation() method that checks the nonce without consuming it. Only pay_invoice consumes the nonce.

Update immediately:

# .NET global tool
dotnet tool update -g LightningEnable.Mcp

Affected versions: v1.5.0

v1.5.0 — Multi-Wallet Support​

  • Added Strike wallet backend with preimage support
  • Added LND REST wallet backend
  • Added Nostr Wallet Connect (NWC) wallet backend
  • Configurable wallet priority via WALLET_PRIORITY env var or config file
  • Config file support at ~/.lightning-enable/config.json
  • L402 license purchase via Lightning payment (6,000 sats, valid forever)
  • Budget controls with dual USD/sats limits

v1.4.0 — L402 Auto-Pay​

  • access_l402_resource tool for automatic L402 payment
  • pay_l402_challenge tool for manual L402 payment
  • Budget enforcement with per-request and per-session limits
  • Payment history tracking

v1.3.0 — Initial Release​

  • pay_invoice — Pay any Lightning invoice
  • check_wallet_balance — Check wallet balance
  • get_payment_history — View payment history
  • get_budget_status — View budget limits
  • OpenNode wallet backend