Verify a CoinPayments IPN before you credit it
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
Payment Rails
Everything that moves coin that is not FaucetPay: node RPC, processors, address validation.
7 entries
Create a NOWPayments invoice and handle the callback
An API key on the way out, a signed and key-sorted JSON payload on the way back. The sorting requirement is the part that trips people.
Verify a Coinbase Commerce webhook
HMAC-SHA256 of the raw body against the X-CC-Webhook-Signature header, and the event types that actually mean money arrived.
Send coin from your own node over JSON-RPC
sendtoaddress against bitcoind, litecoind or dogecoind, with the wallet passphrase handling and the error codes that matter.
Derive deposit addresses from an xpub without a hot wallet
Give every user their own address while the private keys stay offline. The watch-only pattern, and why the gap limit matters.
Send an ERC-20 or BEP-20 token with raw JSON-RPC
Build the transfer calldata, estimate the gas, sign, and broadcast — plus the nonce management that decides whether two payouts collide.
Wait for confirmations before you call a deposit final
Zero-confirmation deposits can be reversed. A confirmations table with a per-coin threshold makes the wait explicit and the crediting safe.