A short, practical guide for developers: how to verify CryptoPayr webhooks, handle retries safely with idempotency, and never double-fulfil an order.
If you are integrating CryptoPayr yourself, two concepts will make your checkout bulletproof: signed webhooks and idempotency. Get these right and you will never double-ship an order or trust a forged callback.
When a payment changes state, CryptoPayr POSTs your webhook_url a JSON body and signs it with your API key using HMAC-SHA256, in the X-CryptoPayr-Signature header. Recompute it and compare before you trust anything:
$sig = hash_hmac('sha256', $rawBody, $YOUR_API_KEY);
if (!hash_equals($sig, $_SERVER['HTTP_X_CRYPTOPAYR_SIGNATURE'])) { http_response_code(401); exit; }
Only act on the payload once the signature matches and the status is COMPLETED.
Networks retry. You may receive the same webhook more than once, so fulfilment must be safe to run repeatedly. The pattern:
tid.200 and stop.On the create side, send an Idempotency-Key header with POST /api/v1/payment/create so a retried create returns the original payment instead of making a second one.
Acknowledge the webhook quickly with a 200, then do any slow fulfilment work in a background job. Slow webhook responses invite more retries.
Run a small real payment end to end and confirm your handler marks the order paid exactly once. The full reference lives in the API docs.
Grab an API key and build a checkout you can trust.
Open a free CryptoPayr account and take your first crypto payment the same day.
Get started for free
Test crypto payments safely with sandbox checks, public testnets, and regtest. Verify checkout, webhooks, confirmations, refunds, and edge cases before...
Secure crypto IPN webhooks with HTTPS, signature checks, replay protection, and idempotency. Learn how to prevent retries from fulfilling orders twice.
Add wallet support to crypto checkout with hosted checkout, plugins, or an API fallback. Cover mobile handoffs, secure requests, and gasless options.