web3e / crypto-gateway-php

v1.0.2 2026-08-03 03:28 UTC

Requires

• php: >=7.4
• ext-curl: *
• ext-hash: *
• ext-json: *

MIT

• payment
• checkout
• gateway
• crypto
• webhook
• USDT
• web3e

Published on Packagist.org on 2026-08-03 03:28 UTC

README

web3e/crypto-gateway-php

PHP SDK for the Web3e crypto payment gateway. Zero runtime dependencies (just ext-curl + ext-hash), PHP 7.4+, so it drops into any host — including plugins that vendor it into a zip.

It does two things:

1. Signs requests to the public REST v1 API (v2 signing scheme: HMAC-SHA256 over METHOD\nPATH\nQUERY\nTIMESTAMP\nNONCE\nSHA256(body), single-use nonce, SM-Idempotency-Key on POST).
2. Verifies inbound webhooks (SM-Webhook-Signature: v1,t=…,s1=…, canonical v1.{id}.{ts}.{body}, ±300s window, constant-time, rotation-aware).

Install

composer require web3e/crypto-gateway-php

If the web3e vendor is already taken on Packagist, we publish as web3e-cc/crypto-gateway-php.

Accept a payment (hosted checkout)

use Web3e\Gateway\Client;

$client = new Client('gwk_public_id', 'api_secret', 'https://api.web3e.cc');

$invoice = $client->createInvoice([
    'orderId'       => '1001',
    'orderAmount'   => '49.90',
    'orderCurrency' => 'USD',
    'successUrl'    => 'https://shop.example/thank-you',
    'cancelUrl'     => 'https://shop.example/cart',
    'callbackUrl'   => 'https://shop.example/ipn/web3e',
]);

header('Location: ' . $invoice['checkoutUrl']); // redirect the buyer

Verify a webhook (IPN)

use Web3e\Gateway\WebhookVerifier;

$raw       = file_get_contents('php://input');
$webhookId = $_SERVER['HTTP_SM_WEBHOOK_ID'] ?? '';
$signature = $_SERVER['HTTP_SM_WEBHOOK_SIGNATURE'] ?? '';

$verifier = new WebhookVerifier('your_webhook_secret');
if (!$verifier->verify($raw, $webhookId, $signature)) {
    http_response_code(401);
    exit;
}
$event   = json_decode($raw, true);
$payment = $event['payment'] ?? [];
// mark $payment['merchantOrderId'] paid when $payment['status'] is credited/overpaid

Wire vocabulary

Fields are camelCase in both directions (orderId, orderAmount, checkoutUrl, payAddress, merchantOrderId). Headers use the platform's universal SM- prefix — SM-Api-Key, SM-Timestamp, SM-Nonce, SM-Signature, SM-Idempotency-Key outbound; SM-Webhook-Id, SM-Webhook-Signature inbound. There is no snake_case or X--prefixed fallback left on the server.

Test

php tests/run.php     # zero-dependency; no composer install required

License

MIT — see LICENSE.