Verify a Coinbase Commerce webhook
HMAC-SHA256 of the raw body against the X-CC-Webhook-Signature header, and the event types that actually mean money arrived.
Tagged “payments”
6 entries
Create a NOWPayments invoice and handle the callback
An API key on the way out, a signed and key-sorted JSON payload on the way back. The sorting requirement is the part that trips people.
Verify a CoinPayments IPN before you credit it
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
Idempotency keys on every operation that moves money
A caller-supplied key with a unique index turns every retry, refresh and double-click into a no-op. The single most valuable column in a payments schema.
Credit a deposit exactly once, however many callbacks arrive
A unique index on your own reference turns duplicate callbacks, browser refreshes and manual replays into no-ops instead of free balance.
Send a user to FaucetPay merchant checkout
An auto-submitting form POST with your own reference in the custom field — the field that makes the deposit traceable when it comes back.