Docs

Changelog

Merchant-visible changes to the API, webhooks, and dashboard. Breaking changes are called out explicitly.

Changes that affect how you build against the platform. Internal refactors are not listed.

2026-08-13#

Security hardening: webhook destinations and delivery responses#

  • Webhook URLs are now validated. Destinations must be public http(s) hosts: URLs with embedded credentials or hostnames resolving to private/internal ranges are rejected on save and re-checked at every delivery. Redirects are never followed. If your stored URL points at an internal host, deliveries to it will now fail — switch to a public endpoint or tunnel.
  • Breaking: the webhook event detail API and dashboard no longer expose your server's response body. The HTTP status code and error string remain available.

Payouts complete on chain confirmation#

A payout is now marked completed — and your balance debited — only after its transaction reaches the network's confirmation target, instead of at broadcast time. The completion email arrives roughly a minute later than before; the payout amount and flow are unchanged.

BTC withdrawals enabled#

Bitcoin joins the payout networks: withdrawals to your registered bitcoin address are now executed on-chain (native SegWit). Network fee is paid by the platform; confirmations target is 3 blocks.

New networks and currencies#

  • Base: ETH, USDT, USDC, POD and xPOD deposits and payouts. xPOD (the ERC-4626 vault wrapper of POD) is priced at its live on-chain conversion ratio, so accrued yield is honoured.
  • Monero: XMR deposits and payouts.
  • USDC on Ethereum and Base.

See the full matrix in Payments & confirmations.

Automatic webhook retries#

Failed webhook deliveries are retried automatically with exponential backoff (~30 s up to ~24 h, 8 attempts total), then marked exhausted. Manual retry from the dashboard remains available at any point, including for exhausted events. See Delivery semantics.

Batch transactions credit every invoice they pay#

One on-chain transaction that pays several invoices (e.g. an exchange batch withdrawal) now credits each of them. Previously only the first matching invoice was credited.

2026-05-15#

Webhook signing secret is now visible and rotatable#

The HMAC secret used to sign outgoing webhooks (X-Webhook-Signature) is now exposed to merchants:

  • On merchant creation, the secret is shown once next to the API key. Copy it to your secret store before closing the dialog.
  • A new "Signing secret" tab on the merchant detail page lets you rotate the value. The new secret is shown once; the old one stops signing immediately.
  • New endpoint: POST /merchants/{id}/rotate-webhook-secret (JWT-authenticated, returns the new value).
  • Existing receivers that already verify X-Webhook-Signature keep working unchanged — only the discoverability of the secret has improved. See Signature scheme and Dashboard → Merchants.

2026-04-17#

Webhook payloads now carry your merchant fields#

Every webhook delivery now includes external_id, description, metadata, and created_at in the JSON body. This lets you reconcile events against your own records without a second API call.

  • Backward compatible — receivers that ignore unknown fields keep working unchanged.
  • Events dispatched before this change still carry the original (thinner) payload — only new invoices get the full payload going forward.
  • See Payload schema.

Webhook delivery: fire-and-forget, with dashboard retry#

The platform now dispatches each webhook once. If your endpoint rejects the delivery or is unreachable, the attempt is stored as failed — and you retry it from the dashboard when you're ready.

  • Why: automatic retry loops were masking real configuration problems on the merchant side.
  • What changed for you: you now see every failed delivery with its HTTP status and response body in the dashboard, and you click Retry explicitly.
  • The full response body (first 4 KB) is captured verbatim — useful for debugging signature mismatches.
  • See Delivery semantics and Retry failed webhooks.

New: Webhook events tab in the dashboard#

Each merchant detail page has a new Webhook events tab showing every delivery attempt: event type, invoice, status, HTTP code, attempts, first 4 KB of the response body, and a retry button.

New: Test payment page#

A new /test-payment route in the dashboard lets you create a real invoice via a form and scan the resulting QR from any wallet. Useful for end-to-end verification of your webhook handler without writing API client code.

Entries before this page existed aren't migrated. If you spot a change that isn't documented and you think it should be, contact support.