Now live on 6 chains—Start accepting payments in 5 minutes
Developer Platform

Crypto payment API
built for developers

Clean REST API, real-time webhooks, and practical code examples. Accept crypto payments with a few lines of code.

Create a payment
curl -X POST https://zateway.com/api/v1/payments \
  -H "X-API-Key: zate_live_..." \
  -H "Content-Type: application/json" \
  -d '{"amount":"50.00","currency":"USDT","chain":"polygon"}'
API Overview

Everything you need to integrate

A single, consistent REST API for creating payments, managing webhooks, and querying transaction data.

Base URL

https://zateway.com/api/v1

Authentication

API key via X-API-Key header

Format

JSON request & response bodies

Key Endpoints

MethodEndpointDescription
POST/paymentsCreate a new payment session
GET/payments/:idRetrieve payment details
POST/payment-linksCreate a reusable payment link
GET/payment-linksList your payment links
GET/currenciesList supported currencies & chains
POST/refundsCreate a refund request
GET/statusCheck API and chain listener health
Quick Start

Accept crypto in 3 steps

From zero to live payments in under five minutes.

1

Get your API key

Sign up and grab your API key from the Dashboard under Settings → API Keys. Your key starts with zate_live_.

2

Create a payment

Send a POST request to create a payment session. You'll receive a checkout URL to redirect your customer. Required fields: amount, currency, and chain. merchantWalletis optional when you've already configured a verified wallet in the dashboard.

curl -X POST https://zateway.com/api/v1/payments \
  -H "X-API-Key: zate_live_..." \
  -H "Content-Type: application/json" \
  -d '{"amount": "50.00", "currency": "USDT", "chain": "polygon"}'
3

Handle the webhook

Register a webhook URL in the Dashboard. We'll notify you when a payment is confirmed, failed, or expired.

Webhook payload
{
  "event": "payment.confirmed",
  "data": {
    "id": "pay_abc123",
    "amount": "50.00",
    "currency": "USDT",
    "chain": "polygon",
    "status": "confirmed",
    "txHash": "0xabc...def",
    "confirmedAt": "2026-03-25T12:00:00Z"
  },
  "timestamp": "2026-03-25T12:00:05Z"
}
Webhooks

Real-time event notifications

Subscribe to payment lifecycle events. Every webhook is signed with HMAC-SHA256 so you can verify authenticity.

Events

EventDescription
payment.confirmingPayment detected on-chain, awaiting block confirmations
payment.confirmedPayment has been confirmed on-chain
payment.late_confirmedPayment confirmed after session expiry (still valid)
payment.underpaidReceived amount is less than expected
payment.overpaidReceived amount exceeds expected — excess should be returned
payment.expiredPayment session expired without payment
payment.failedPayment failed or was rejected
refund.requestedRefund request created by customer or merchant
refund.completedRefund marked as completed by merchant
refund.rejectedRefund request declined by merchant

Signature Verification

Every webhook includes three headers for verification: X-Zateway-Signature (format: sha256=<hmac>), X-Zateway-Timestamp (unix seconds), and X-Zateway-Nonce (unique string). Compute the signature over the raw request body with HMAC-SHA256(secret, timestamp.nonce.raw_body).

Node.js — Verify signature
const crypto = require('crypto');
function verifyWebhook(rawBody, headers, secret) {
  const signature = headers['x-zateway-signature'];
  const timestamp = headers['x-zateway-timestamp'];
  const nonce = headers['x-zateway-nonce'];
  if (!signature || !timestamp || !nonce) return false;
  // Check timestamp freshness (5 min window)
  const age = Math.abs(Date.now() / 1000 - parseInt(timestamp, 10));
  if (age > 300) return false;
  // Verify HMAC over the raw request body
  const message = `${timestamp}.${nonce}.${rawBody}`;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret)
    .update(message)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}
Error Handling

Predictable error responses

All errors return a JSON object with a single error string field.

HTTP Status Codes

CodeStatusDescription
400Bad RequestInvalid parameters or missing required fields
401UnauthorizedMissing or invalid API key
403ForbiddenAPI key lacks permission for this action
404Not FoundResource does not exist
429Too Many RequestsRate limit exceeded (varies by endpoint)
500Internal Server ErrorSomething went wrong on our end
Rate limits: API endpoints are rate-limited per key (10 req/min for payments, 30 req/min for reads, 200 req/min per IP). Exceeding limits returns a 429 status with a Retry-After header. See full rate limit table.

Error Response Format

Example error response
{
  "error": "Amount must be a positive number"
}
Get Started

Ready to integrate?

Start building with Zateway today. Full API reference, guides, and support are just a click away.

Read the Docs Create Account