Connect non-custodial wallets & generate sk_test_ API keys
Register at /merchant/register, paste your destination EVM, Solana, TRON, or multisig wallet addresses, and generate a free API Testnet key.
Migrer depuis Cryptomus to Non-Custodial XPayr (0.5%)
Stop leaving revenue inside a custodial processor account that can freeze withdrawals during sudden KYC re-reviews, and replace legacy MD5 base64 body hashes with modern header-based HMAC-SHA256 security.
🔄 Open Interactive Payload Translator
⚡ Test Sandbox de paiement en direct
⚖️ XPayr face à Cryptomus
📊 Commercial Breakdown
Cutover Time~12 Minutes (Parallel Safe)
Cryptomus Fee0.4%–2.0% + conversion & custodial withdrawal fees
XPayr Frais de PasserelleFlat 0.5% ($0/mo · $0 Sweep)
XPayr Modèle de garde100 % Non dépositaire (99.5% Direct)
Why Engineering & Finance Teams Switch Away From Cryptomus
Cryptomus holds incoming customer funds inside a custodial merchant balance and charges secondary network fees on withdrawal.
Cryptomus webhook verification mutates the JSON body (removing sign, re-encoding JSON with escaped slashes, base64 + MD5), causing frequent PHP/Node mismatch bugs.
Account-level moderation reviews can pause access to already-earned merchant balances.
Field-by-Field API & Webhook Mapping (Cryptomus → XPayr v1)
Keep your existing database order schema intact — map these 6 fields to cut over cleanly.
| Integration Layer | Cryptomus (Legacy) | XPayr Non-Custodial v1 |
|---|---|---|
| Request Authentication | merchant UUID + sign: md5(base64(body) + key) |
Standard Authorization: Bearer sk_live_... |
| Create Invoice | POST https://api.cryptomus.com/v1/payment |
POST https://xpayr.com/api/v1/payments |
| Network Specification | currency: "USDT", network: "tron" |
token: "USDT", network: "tron" (or multi-chain buyer choice) |
| Webhook Integrity | Body field sign (MD5 — cryptographically deprecated) |
Header X-XPayr-Signature (Raw-body HMAC-SHA256) |
| Underpaid Orders | payment_status === "paid_over" / "wrong_amount" |
payment.underpaid_accepted (built-in 1% max $0.50 tolerance) |
| Settlement Destination | Cryptomus internal custodial wallet |
99.5% directly to your own self-custodial wallet |
Drop-In Migration Adapter (PHP 8.1+)
Copy-paste replacement ready for Testnet (sk_test_...) and Mainnet (sk_live_...).
<?php
declare(strict_types=1);
/**
* Replaces Cryptomus md5(base64_encode(json_encode($data)) . $apiKey) verification
* with clean, unmutated raw-body HMAC-SHA256 verification.
*/
$rawBody = (string) file_get_contents('php://input');
$sigHeader = preg_replace('/^sha256=/i', '', (string) ($_SERVER['HTTP_X_XPAYR_SIGNATURE'] ?? ''));
$expected = hash_hmac('sha256', $rawBody, (string) getenv('XPAYR_WEBHOOK_SECRET'));
if (!hash_equals($expected, $sigHeader)) {
http_response_code(401);
exit('Invalid signature');
}
$event = json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);
if (in_array($event['event'] ?? '', ['payment.completed', 'payment.underpaid_accepted'], true)) {
$orderId = $event['data']['order_id'] ?? '';
// Mark order paid — 99.5% is already in your wallet!
}
http_response_code(200);
echo json_encode(['ok' => true]);
4-Step Zero-Downtime Canary Cutover Checklist
Deploy the X-XPayr-Signature HMAC-SHA256 webhook adapter
Add the raw-body HMAC-SHA256 verification handler alongside your existing Cryptomus callback endpoint and test events in /tools/webhook-tester.
Canary 10%–25% of live checkout sessions in parallel
Route a slice of live crypto orders to POST /api/v1/payments (or enable the XPayr storefront plugin) to verify instant règlement direct de 99.5% sur portefeuille.
Cut over 100% of traffic & export clean ERP ledgers
Switch primary crypto checkout routing to XPayr, withdraw any remaining custodial float from Cryptomus, and export QuickBooks/Xero CSVs via /accounting.
Questions fréquentes — Switching From Cryptomus
Can XPayr freeze or hold my settled funds like Cryptomus?
Technically impossible. XPayr never holds merchant private keys or pools balances — 99.5% settles directly into your own wallet on every confirmed payment.
Do we still get Pterodactyl, Paymenter, WHMCS, and Blesta hosting plugins?
Yes! XPayr supports WHMCS (/plugins/whmcs), Blesta (/plugins/blesta), and Pterodactyl/Paymenter (/plugins/pterodactyl) out of the box.
Does XPayr support Telegram bots and TON payments like Cryptomus?
Yes — XPayr supports native TON & Jetton USDT (/networks/ton, /wallets/tonkeeper) and Telegram Mini-Apps (/plugins/telegram).