A short, practical guide for developers: how to verify CryptoPayr webhooks, handle retries safely with idempotency, and never double-fulfil an order.
If you are integrating CryptoPayr yourself, two concepts will make your checkout bulletproof: signed webhooks and idempotency. Get these right and you will never double-ship an order or trust a forged callback.
When a payment changes state, CryptoPayr POSTs your webhook_url a JSON body and signs it with your API key using HMAC-SHA256, in the X-CryptoPayr-Signature header. Recompute it and compare before you trust anything:
$sig = hash_hmac('sha256', $rawBody, $YOUR_API_KEY);
if (!hash_equals($sig, $_SERVER['HTTP_X_CRYPTOPAYR_SIGNATURE'])) { http_response_code(401); exit; }
Only act on the payload once the signature matches and the status is COMPLETED.
Networks retry. You may receive the same webhook more than once, so fulfilment must be safe to run repeatedly. The pattern:
tid.200 and stop.On the create side, send an Idempotency-Key header with POST /api/v1/payment/create so a retried create returns the original payment instead of making a second one.
Acknowledge the webhook quickly with a 200, then do any slow fulfilment work in a background job. Slow webhook responses invite more retries.
Run a small real payment end to end and confirm your handler marks the order paid exactly once. The full reference lives in the API docs.
Grab an API key and build a checkout you can trust.
Open a free CryptoPayr account and take your first crypto payment the same day.
Get started for free
Learn how to create efficient invoices in cryptocurrency with clear steps. Streamline your billing process and embrace digital payments today!
Learn how marketplace split payments work, optimize transactions, and ensure timely payouts for vendors with this comprehensive builder's guide.
Learn how to accept stablecoin payments easily and quickly with hosted checkouts or integrated payment gateways in this U.S. guide.