xpayr/xpayr-php

Official PHP SDK for the XPayr Merchant API.

v0.1.0 2026-07-17 17:13 UTC

Requires

• php: >=8.1
• ext-curl: *
• ext-json: *

MIT

• webhooks
• payment-gateway
• crypto-payments
• xpayr

Published on Packagist.org on 2026-07-17 18:12 UTC

README

Official PHP SDK for XPayr payment sessions, merchant operations, webhook verification, and server-side crypto checkout integrations.

Status: Public beta · v0.1.0

Purpose

A PHP 8.1+ client for XPayr Merchant API v1 with cURL transport, structured exceptions, and secure webhook verification.

Included

• Payment, merchant, network, and webhook API methods
• PSR-4 package layout and Composer metadata
• Constant-time HMAC-SHA256 webhook verification

Quick start

composer install
composer test

Install the published package:

composer require xpayr/xpayr-php:^0.1

For repository development, run composer install, composer lint, and composer test.

Usage

<?php

use XPayr\Webhook;
use XPayr\XPayrClient;

$xpayr = new XPayrClient($_ENV['XPAYR_SECRET_KEY']);
$session = $xpayr->createPayment([
    'amount' => '49.90',
    'currency' => 'USDC',
    'network' => 'bsc-testnet',
    'order_id' => 'ORDER-1001',
]);

// In the webhook route, verify the untouched request body.
$event = Webhook::constructEvent(
    file_get_contents('php://input'),
    $_SERVER['HTTP_X_XPAYR_SIGNATURE'] ?? '',
    $_ENV['XPAYR_WEBHOOK_SECRET'],
);

Use an XPayr test key before live credentials. Never expose sk_test_*, sk_live_*, agent keys, webhook secrets, or wallet private keys in browser code or commits.

Documentation

• Developer Hub
• Merchant API documentation
• Testnet checkout guide
• Webhook signature guide

Security

Read SECURITY.md before reporting a vulnerability. Payment completion must be based on verified XPayr webhook/API state and canonical on-chain evidence, not browser callbacks alone.

License

MIT. See LICENSE.