When a payment confirms, My Crypto Server fires a webhook to your backend so your store can mark the order paid and fulfil automatically. Every webhook is signed with HMAC-SHA256 and timestamped with replay protection, so your app never trusts an event it can't verify.
Verify the signature over the raw body, check the timestamp, and act idempotently. A confirmed on-chain payment triggers exactly one reliable state change in your system.
Each delivery is signed with your secret, so you can prove the event came from your server and wasn't forged.
Timestamps let you reject stale or replayed deliveries, closing off a common webhook attack.
Deliveries carry stable identifiers, so a retried webhook can't double-fulfil an order.
Compute an HMAC-SHA256 over the raw request body with your webhook secret, compare it to the signature header, and reject stale timestamps, before marking the order paid.
Deliveries are retried, and because they're idempotent, processing a retry is safe. You won't miss or double-count a confirmed payment.
$699 one-time with code MCSINTRO $999, full source, every v1 update included, 0% platform fees.
Read the docs