QuickPay is a hosted crypto payment API. Send your customer to a QuickPay-hosted payment page, and poll for confirmation — no wallets, no node infrastructure required on your side. All amounts are denominated in USD; QuickPay handles the crypto conversion in real time.

Base URL: https://4376hdfdaf.shop

Invoice creation requires an API key passed via the X-API-Key request header. Keys are issued per project from the admin panel. Status and cancel endpoints are unauthenticated.

Pass a callback_url when creating an invoice and QuickPay will POST a signed JSON payload to that URL the moment the invoice status changes to confirmed. Use this to trigger server-side actions — like upgrading a user's account — without polling.

QuickPay sends a JSON body with the following fields:

{
  "tx_id":         "3f2e1a...",
  "status":        "confirmed",
  "coin":          "eth",
  "amount":        49.99,
  "tx_hash":       "0xabc123...",
  "confirmations": 12,
  "metadata":      "user_id=abc123"
}

Every webhook request includes an X-QuickPay-Signature header of the form sha256=<hex>. The signature is an HMAC-SHA256 of the raw request body using your project's webhook secret (visible on the admin key detail page). Always verify this before acting on a webhook.

import hmac, hashlib

WEBHOOK_SECRET = "whsec_..."  # from admin panel

def verify(raw_body: bytes, signature_header: str) -> bool:
    expected = "sha256=" + hmac.new(
        WEBHOOK_SECRET.encode(),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

# FastAPI / Starlette example
from fastapi import Request, HTTPException

@app.post("/webhooks/quickpay")
async def handle_webhook(request: Request):
    body = await request.body()
    sig  = request.headers.get("X-QuickPay-Signature", "")

    if not verify(body, sig):
        raise HTTPException(status_code=400, detail="Invalid signature")

    data = await request.json()
    if data["status"] == "confirmed":
        user_id = data.get("metadata")  # e.g. "user_id=abc123"
        # upgrade user here
    return {"ok": True}

const crypto = require("crypto");

const WEBHOOK_SECRET = "whsec_..."; // from admin panel

app.post("/webhooks/quickpay", express.raw({ type: "application/json" }), (req, res) => {
  const sig      = req.headers["x-quickpay-signature"] ?? "";
  const expected = "sha256=" + crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(req.body)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(400).send("Invalid signature");
  }

  const data = JSON.parse(req.body);
  if (data.status === "confirmed") {
    // upgrade user using data.metadata
  }
  res.json({ ok: true });
});

Important: use hmac.compare_digest / crypto.timingSafeEqual — never a plain string comparison — to prevent timing attacks. After verifying, also call GET /status/{tx_id} from your server to independently confirm the status before granting access.

An invoice moves through the following states:

Prices are fetched from CoinGecko and cached for 60 seconds. A ±1% tolerance (capped at $0.10) is applied to the expected crypto amount to account for rounding and minor price movement between invoice creation and payment.