Install, paste your private key and webhook secret, done. The customer picks a chain on a hosted checkout page and the order completes from a signed webhook. No code.
WordPress 6.0+, WooCommerce 7.0+
PrestaShop 1.7 and 8.x
OpenCart 4.x only
Put one payment through for the smallest amount the API allows, on a real store, and watch the order move from awaiting payment to paid. That single test exercises the whole path: invoice creation, the checkout page, the on-chain deposit, the webhook and its signature check, and the order transition. Anything broken in that chain shows up in the one place it matters, before a customer finds it.
Check that your webhook URL is reachable from outside. A staging site behind HTTP auth, an IP allowlist, or a security plugin that blocks unknown POSTs will all accept the invoice and then never confirm the order.
The plugins are GPL, so one that is close to what you need is a starting point rather than a dead end. If you are integrating a platform these do not cover, the whole contract is four steps: create an invoice, redirect to checkout_url, verify the webhook signature, move the order. The two apps we run do exactly that, and you can open either one to see the shape before you write anything.
POST /your/webhook
X-Buxapi-Event: invoice.paid
X-Buxapi-Delivery: 90218
X-Buxapi-Signature: t=1786012800,v1=7d3a...
signature = HMAC-SHA256(webhook_secret, "{t}.{raw body}")Three things to get right, in every language: sign over the raw body, because re-serialising parsed JSON changes the bytes; compare with a constant-time function, because a short-circuiting comparison leaks how much of the signature was correct; and reject timestamps older than a few minutes, because otherwise a captured delivery replays forever. The webhook reference has the rest.
Magento, Shopify, OpenCart 3.x and custom carts are not covered yet. Tell us what you are on and we will say whether it is on the list or quote you for it.