How crypto payment gateways work

A crypto payment gateway sits between your checkout and a dozen blockchains. It turns a price into an exact crypto amount, gives the customer somewhere to send it, watches the chain until the transfer is final, and tells your site the order is paid. This post follows one payment through easyway, step by step, with the real numbers the system uses.

1. The invoice

Everything starts with an invoice: an amount, usually in USD, plus your order id and where to send the customer afterwards. Your backend creates it through the API (POST /v1/invoices), or a payment link creates one for each visitor. The invoice gets a hosted checkout page and an expiry time — 60 minutes by default, adjustable from 5 minutes to 24 hours.

2. Turning dollars into an exact crypto amount

On the checkout page the customer picks one of 23 coins on 12 networks. At that moment the gateway locks the crypto amount. Stablecoins such as USDT and USDC are priced at exactly 1 USD. Every other coin is priced from up to four public sources (CoinGecko, Binance, KuCoin and Coinbase), refreshed at most once a minute; a source more than 3 % away from the median is ignored, and if two sources disagree the previous price is kept. If no fresh price is available for 15 minutes, the gateway refuses to quote rather than sell at a stale price. The amount is rounded up, never down, so the merchant is not short-changed by rounding.

3. Somewhere to send it

The hard part of accepting crypto is knowing which customer paid. A gateway solves it in one of two ways. On most networks each invoice gets its own deposit address, derived from an extended public key: the API server can create addresses without holding any private key. On TON and the XRP Ledger every address costs a reserve or a contract deployment, so the gateway uses one shared address and a unique numeric memo (destination tag on XRP) per invoice; a transfer without the right memo is not credited automatically.

4. Waiting for the chain

A separate watcher process reads each chain and reports transfers to the deposit addresses and memos it knows about. A transfer is only credited after the number of confirmations in the table above: a few blocks on fast-final chains like TON, Solana and XRP, more on chains where blocks can be reorganised. Until then the checkout shows the payment as "confirming". Each on-chain transfer is credited exactly once — the database refuses a second report of the same transaction.

5. Paid, underpaid or late

When the confirmed amount covers the quote, the invoice becomes paid. Customers often send slightly less (an exchange deducts its fee, for example), so a 1 % underpayment tolerance — adjustable from 0 to 5 % — still counts that as paid. Anything further short makes the invoice underpaid: the received part is credited and the checkout asks for the rest. Payments that arrive after the invoice expired are still watched for 7 more days and credited. The underpaid and late payments guide lists every case.

6. Telling your site

Each status change sends a webhook such as invoice.paid to your server, signed with HMAC-SHA256 over a timestamp and the body, so your code can prove it came from the gateway and is not a replay. If your server is down, the delivery is retried up to 8 times over about 45 hours. Your code checks the signature, looks up the order and fulfils it — see how to verify webhook signatures.

7. Fees, balance and withdrawals

easyway deducts a 0.5% fee from each confirmed payment and credits the rest to your balance, in the coin the customer paid with — there is no automatic conversion. The balance is held by easyway until you withdraw it, from the dashboard or the payouts API, to a wallet address you have whitelisted; each withdrawal pays a fixed network fee per coin, listed on the pricing page. Behind the scenes, a separate signing service with no inbound network access moves deposits into the operating wallets and sends the withdrawals; the server that runs the API and the website holds no private keys. The security page describes this in more detail.

What to look for in a gateway

Whichever provider you use, ask the same questions this post answered: where the price comes from and when it is locked, how many confirmations each coin waits for, what happens on underpayment and late payment, how webhooks are signed and retried, who holds the money until you withdraw it, and what each withdrawal costs. A gateway that answers them in its documentation is easier to build on. To try easyway's answers yourself, create a test key and run the flow in the sandbox, or read how to accept cryptocurrency payments on your website.