A short, practical guide for developers: how to verify CryptoPayr webhooks, handle retries safely with idempotency, and never double-fulfil an order.
If you are integrating CryptoPayr yourself, two concepts will make your checkout bulletproof: signed webhooks and idempotency. Get these right and you will never double-ship an order or trust a forged callback.
When a payment changes state, CryptoPayr POSTs your webhook_url a JSON body and signs it with your API key using HMAC-SHA256, in the X-CryptoPayr-Signature header. Recompute it and compare before you trust anything:
$sig = hash_hmac('sha256', $rawBody, $YOUR_API_KEY);
if (!hash_equals($sig, $_SERVER['HTTP_X_CRYPTOPAYR_SIGNATURE'])) { http_response_code(401); exit; }
Only act on the payload once the signature matches and the status is COMPLETED.
Networks retry. You may receive the same webhook more than once, so fulfilment must be safe to run repeatedly. The pattern:
tid.200 and stop.On the create side, send an Idempotency-Key header with POST /api/v1/payment/create so a retried create returns the original payment instead of making a second one.
Acknowledge the webhook quickly with a 200, then do any slow fulfilment work in a background job. Slow webhook responses invite more retries.
Run a small real payment end to end and confirm your handler marks the order paid exactly once. The full reference lives in the API docs.
Grab an API key and build a checkout you can trust.
Open a free CryptoPayr account and take your first crypto payment the same day.
Get started for free
Easily accept cryptocurrency on your WordPress or WooCommerce site with CryptoPayr. Enjoy low fees and seamless integration. Start today!
Merchants must understand that sales tax applies to crypto payments just like cash. Discover essential compliance steps and valuation rules.
Discover how to accept crypto on Shopify easily. Choose from USDC support or a versatile crypto payment gateway for your store.