A short, practical guide for developers: how to verify CryptoPayr webhooks, handle retries safely with idempotency, and never double-fulfil an order.
If you are integrating CryptoPayr yourself, two concepts will make your checkout bulletproof: signed webhooks and idempotency. Get these right and you will never double-ship an order or trust a forged callback.
When a payment changes state, CryptoPayr POSTs your webhook_url a JSON body and signs it with your API key using HMAC-SHA256, in the X-CryptoPayr-Signature header. Recompute it and compare before you trust anything:
$sig = hash_hmac('sha256', $rawBody, $YOUR_API_KEY);
if (!hash_equals($sig, $_SERVER['HTTP_X_CRYPTOPAYR_SIGNATURE'])) { http_response_code(401); exit; }
Only act on the payload once the signature matches and the status is COMPLETED.
Networks retry. You may receive the same webhook more than once, so fulfilment must be safe to run repeatedly. The pattern:
tid.200 and stop.On the create side, send an Idempotency-Key header with POST /api/v1/payment/create so a retried create returns the original payment instead of making a second one.
Acknowledge the webhook quickly with a 200, then do any slow fulfilment work in a background job. Slow webhook responses invite more retries.
Run a small real payment end to end and confirm your handler marks the order paid exactly once. The full reference lives in the API docs.
Grab an API key and build a checkout you can trust.
Open a free CryptoPayr account and take your first crypto payment the same day.
Get started for free
Protect users and merchants from crypto fraud: keep seeds offline, revoke approvals, use strong passwords, and add real time checks to block scams.
Discover the key differences between custodial and non-custodial gateways to choose the right one for your merchant needs. Make an informed decision!
Discover who pays gas fees on Ethereum, explore how costs can shift, and learn strategies to minimize your expenses.