Grid Global Payments

Grid is Lightspark's global payments network. Striga uses it to deliver cross-border payouts into local payment systems — a US bank account, a Mexican CLABE over SPEI, a Brazilian PIX key — while you fund every payout from the USDC balance you already hold with us.

You do not need a Grid account, local entities, or pre-funded currency accounts in each country. Striga holds the Grid relationship, screens the recipients, and settles the payout on your behalf.

Supported corridors

Every payout is funded in USDC. Maximum amounts are set per corridor by the receiving institution and can move with the exchange rate — if a payout exceeds one, the API returns the limit in the error message.

Which currencies are enabled is a per-application setting. Contact us to enable a corridor for your application.

How a payout works

1. Add a recipient. The recipient (called a beneficiary) is registered once and reused. Striga runs sanctions screening on it, so a new recipient starts as PENDING and becomes ACTIVE when screening clears. Only ACTIVE recipients can be paid.
2. Create a quote. Grid locks an exchange rate for a few minutes and returns the exact amount of USDC required. USD payouts lock the amount you send; MXN and BRL payouts lock the amount the recipient receives, so the recipient gets exactly the figure you asked for.
3. Confirm. The payout is confirmed with two-factor authentication and the USDC is debited from your account.
4. Settlement. Striga funds the quote and Grid pays the recipient over the local rail. The payout ends in COMPLETED, or FAILED / EXPIRED / REFUNDED if it could not be delivered — a refunded payout returns the funds to your USDC account.

Your Striga fee for each corridor is configured on your application and is charged on top of the quote. It is returned on every payout as feeEstimate, alongside the fees Grid included in the quote (fees).

Payouts are created and confirmed from your Striga dashboard. The two endpoints in this section give you programmatic, read-only access to the same data for reconciliation and reporting.

The reporting endpoints

Both are scoped to the authenticated application, return newest first, and page with limit (1-100, default 50) and offset (default 0). Each response carries a total so you can page until you have everything.

Both endpoints require the LIST_BENEFICIARIES and LIST_PAYOUTS permissions on your application — contact us if you get a 403 with error code 30042.

Authentication

These endpoints use the same application authentication as the rest of the Striga API: the api-key header plus an Authorization: HMAC <timestamp>:<signature> header, as described in Authenticating with the API.

🚧

Sign the path without the environment root

The environment root (/api/v1 on sandbox, /v0 on production) is stripped before the request reaches the API, so it is not part of the signature. In both environments sign /grid/payouts/list — not /api/v1/grid/payouts/list or /v0/grid/payouts/list.

import crypto from 'crypto';

const endpoint = '/grid/payouts/list';        // NOT /api/v1/grid/payouts/list
const body = { status: 'COMPLETED', limit: 50 };

const time = Date.now().toString();           // milliseconds
const bodyHash = crypto
  .createHash('md5')
  .update(JSON.stringify(body))               // '{}' for an empty body
  .digest('hex');

const signature = crypto
  .createHmac('sha256', process.env.STRIGA_API_SECRET!)
  .update(time + 'POST' + endpoint + bodyHash)
  .digest('hex');

// Production; on sandbox use https://www.sandbox.striga.com/api/v1
const response = await fetch(`https://www.api.striga.com/v0${endpoint}`, {
  method: 'POST',
  headers: {
    'api-key': process.env.STRIGA_API_KEY!,
    Authorization: `HMAC ${time}:${signature}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

📘

Reconciling payouts with recipients

POST /grid/payouts/list returns a beneficiaryId on each payout. Fetch your recipients once with POST /grid/beneficiaries/list and keep them in a map keyed by id — recipient details do not change once created, so a single call is usually enough to label an entire page of payouts.