About this plugin
Overview
Xcash for WooCommerce enables merchants to accept crypto payments through the Xcash payment gateway. Customers complete payments on Xcash’s hosted checkout while WooCommerce stays in sync via secure webhooks. The gateway works with both classic shortcodes and WooCommerce Checkout Blocks, supports fiat-denominated invoices, and offers bilingual (English/Chinese) strings out of the box.
Features
- Seamless Xcash gateway integration for WooCommerce orders with automatic redirect to the hosted pay_url.
- Fiat-denominated invoices (USD, CNY, EUR, JPY, HKD) with Xcash-managed crypto conversion.
- Optional JSON-based methods filter to limit coin-chain combinations presented to shoppers.
- Built-in “Test Configuration” button to validate credentials without placing a live order.
- Hardened webhook handler with nonce and per-invoice idempotency plus HMAC-SHA256 signature verification.
- Compatible with WooCommerce Checkout Blocks, High-Performance Order Storage (HPOS), and PHP 7.4–8+.
- Includes English and Simplified Chinese translations for admin and frontend strings.
Requirements
- WordPress 5.8 or higher.
- WooCommerce 5.0 or higher (tested up to WooCommerce 10.9).
- PHP 7.4 or higher.
- Active Xcash merchant account with App ID and HMAC key.
How It Works
- Shopper chooses “Xcash” during checkout.
- The plugin creates an invoice through the Xcash API using a bounded unique WooCommerce order reference as out_no and the order’s WooCommerce currency as the pricing currency.
- Customer is redirected to the Xcash-hosted payment page ( pay_url ) to finalize the crypto transfer.
- Xcash notifies the store via webhook once the payment is detected and confirmed.
- The order is automatically marked as paid and annotated with invoice/transaction details.
External Service
This plugin connects to Xcash, a cryptocurrency payment gateway, to create hosted crypto checkout invoices and receive payment status notifications. sh/privacy/.
sh and enter the project App ID and HMAC key in the WooCommerce gateway settings. sh and can be changed if the merchant runs their own compatible Xcash gateway.
sh/v1/invoice by default). The request includes authentication headers ( XC-Appid, XC-Nonce, XC-Timestamp, and XC-Signature ) and an invoice JSON body containing the WooCommerce order reference ( out_no ), order title, order total amount, pricing currency, invoice duration, the store return URL, the store webhook notification URL, and optional merchant-configured payment method restrictions.
After the invoice is created, the shopper is redirected to the hosted Xcash payment URL returned by the service. When Xcash detects and confirms payment, Xcash sends a signed webhook request back to the store.
The plugin validates the signature and stores invoice/payment identifiers and transaction details from the webhook, such as Xcash invoice ID ( sys_no ), merchant order reference ( out_no ), confirmation flag, cryptocurrency, payment amount, pay address, transaction hash, chain, and block number, as WooCommerce order metadata and displays the core fields on the admin order screen.
Gateway Configuration
- Navigate to WooCommerce → Settings → Payments → Xcash and enable the gateway.
- Set the title/description displayed to customers.
- Enter your Xcash App ID and HMAC Key from the Xcash console.
- Keep the default gateway URL ( https://pay.xca.sh ) or change it to your own compatible gateway.
- The invoice pricing currency is taken automatically from your WooCommerce store currency, so make sure it is a fiat currency supported by Xcash.
- Optionally specify allowed payment methods as JSON — e.g. {"USDT":["ethereum","tron"]}.
- Adjust the payment duration (5–30 minutes, default: 20 minutes) if needed.
- Use the “Test Configuration” button to confirm the credentials before going live.
Webhook & Security
- Webhook endpoint: https://your-site.com/?wc-api=xcash_webhook.
- The plugin sends this endpoint automatically as the invoice-level notify_url when creating invoices.
- Every webhook is validated by checking the XC-Appid, XC-Nonce, XC-Timestamp, and XC-Signature headers.
- Nonces are stored as transients and each paid invoice is marked as processed to block replay attempts; the request timestamp is covered by the HMAC signature rather than checked against a fixed time window.
- Detailed debug logs are written through WooCommerce’s logging system ( wc_get_logger ).
Localization
- Text Domain: xcash-for-woocommerce.
- Domain Path: /languages.
- Bundled translations: English (default) and Simplified Chinese.
Compatibility
- WooCommerce Checkout Blocks integration via Xcash_WC_Gateway_Blocks_Support.
- Declares compatibility with WooCommerce High-Performance Order Storage (custom order tables).
- Supports both shortcode-based and block-based checkout flows.