A short, practical guide for developers: how to verify CryptoPayr webhooks, handle retries safely with idempotency, and never double-fulfil an order.
If you are integrating CryptoPayr yourself, two concepts will make your checkout bulletproof: signed webhooks and idempotency. Get these right and you will never double-ship an order or trust a forged callback.
When a payment changes state, CryptoPayr POSTs your webhook_url a JSON body and signs it with your API key using HMAC-SHA256, in the X-CryptoPayr-Signature header. Recompute it and compare before you trust anything:
$sig = hash_hmac('sha256', $rawBody, $YOUR_API_KEY);
if (!hash_equals($sig, $_SERVER['HTTP_X_CRYPTOPAYR_SIGNATURE'])) { http_response_code(401); exit; }
Only act on the payload once the signature matches and the status is COMPLETED.
Networks retry. You may receive the same webhook more than once, so fulfilment must be safe to run repeatedly. The pattern:
tid.200 and stop.On the create side, send an Idempotency-Key header with POST /api/v1/payment/create so a retried create returns the original payment instead of making a second one.
Acknowledge the webhook quickly with a 200, then do any slow fulfilment work in a background job. Slow webhook responses invite more retries.
Run a small real payment end to end and confirm your handler marks the order paid exactly once. The full reference lives in the API docs.
Grab an API key and build a checkout you can trust.
Open a free CryptoPayr account and take your first crypto payment the same day.
Get started for freeA white-label gateway lets you offer crypto payments — or a full exchange — under your own brand. Here is what that means and how CryptoPayr makes it possible.
Chargebacks cost online businesses billions a year. Here is why crypto payments remove them entirely — and what that means for your margins and your stress levels.
Why does a crypto checkout ask which "network"? What's a confirmation, and why wait for one? Three words explain almost everything a merchant needs to know — here they are, in plain language.