Crypto Payment Acceptance on Website

Cryptocurrency Payment Integration on Website

Accepting crypto payments without intermediaries is direct blockchain work: address generation, transaction monitoring, block confirmation. With intermediaries (NOWPayments, CoinGate, BitPay) — API similar to classic payment gateway, but with volatility and irreversibility features. Both approaches make sense in different situations.

Implementation via intermediary takes 2–3 working days. Self-hosted for one network — 5–8 days.

Via Payment Gateway (Recommended)

NOWPayments, CoinGate, BitPay take 0.5–1% commission and solve for you: conversion, network monitoring, confirmations, exchange rate risks (if immediate conversion enabled). Integration similar to Stripe.

Direct USDT/USDC Reception (TRC-20, ERC-20)

Without intermediaries, but with exchange rate risk only for stablecoins. For each order unique address generated:

use kornrunner\Ethereum\Ethereum;

class WalletService
{
    private string $masterPrivateKey;

    public function generateDepositAddress(int $orderId): string
    {
        // HD Wallet: master key + path m/44'/195'/0'/0/{orderId}
        $derivedKey = $this->deriveKey($this->masterPrivateKey, $orderId);
        $eth        = new Ethereum();
        return $eth->getAddress($derivedKey->getPublicKey());
    }
}

For TRC-20 (Tron) different derivation used, but concept same — HD Wallet with deterministic addresses. Knowing master key and index, always can recover address and check balance.

Monitoring Fund Arrival

Blockchain events don't come in webhook — need to query network. For Ethereum/ERC-20:

import { ethers } from 'ethers';

const provider = new ethers.JsonRpcProvider(process.env.ETH_RPC_URL); // Alchemy, Infura

// Subscribe to Transfer events of ERC-20 contract
const usdcContract = new ethers.Contract(USDC_ADDRESS, ERC20_ABI, provider);

usdcContract.on('Transfer', async (from, to, amount, event) => {
    const pendingOrder = await Order.findByDepositAddress(to);
    if (!pendingOrder) return;

    const decimals     = 6; // USDC
    const receivedUSDC = Number(ethers.formatUnits(amount, decimals));

    if (receivedUSDC >= pendingOrder.amount_usd * 0.99) { // 1% tolerance for fees
        await confirmOrderPayment(pendingOrder, event.transactionHash, event.blockNumber);
    }
});

Wait minimum 6 confirmations (blocks) for Ethereum, 20+ for Bitcoin, 19+ for Tron before final order confirmation.

Waiting for Confirmations

async function waitForConfirmations(
    txHash: string,
    requiredConfirmations: number = 6
): Promise<boolean> {
    const tx = await provider.getTransaction(txHash);
    if (!tx) return false;

    const receipt = await provider.waitForTransaction(txHash, requiredConfirmations);
    return receipt !== null && receipt.status === 1;
}

Storing Payment Information

CREATE TABLE crypto_payments (
    id               bigserial PRIMARY KEY,
    order_id         bigint        NOT NULL REFERENCES orders(id),
    network          varchar(20)   NOT NULL, -- 'eth', 'tron', 'btc'
    token            varchar(20)   NOT NULL, -- 'USDT', 'USDC', 'BTC'
    deposit_address  varchar(100)  NOT NULL UNIQUE,
    expected_amount  numeric(18,8) NOT NULL,
    received_amount  numeric(18,8),
    tx_hash          varchar(100),
    confirmations    int           DEFAULT 0,
    status           varchar(20)   NOT NULL DEFAULT 'awaiting',
    expires_at       timestamptz   NOT NULL, -- usually 30–60 minutes
    created_at       timestamptz   NOT NULL DEFAULT now()
);

Payment time limit (expires_at) mandatory. Exchange rate fixed at order creation time. If client doesn't pay in 30 minutes — order cancelled, address can be reused (though better not to).

Exchange Rate and Conversion

At order creation exchange rate fixed from external source (CoinGecko, Binance API). Crypto amount calculated from fiat amount:

$btcRate  = $this->priceService->getRate('BTC', 'USD'); // e.g., 65000
$btcAmount = round($order->total_usd / $btcRate, 8);
// Display to customer: pay 0.00023076 BTC

1–2% tolerance for network fees and time gap — standard practice.

Refunds

Refunding crypto payment — manual process. Automation impossible without storing private keys in hot wallet, creating security risks. Standard practice: manager manually sends transaction to customer wallet. Wallet address need to request from customer when initiating refund.

Security

Private keys stored in HSM or HashiCorp Vault, not in DB or .env. Deposit addresses — derivatives of master key, not standalone keys. Access to master key — only from server monitoring process, not from web application.