WordPress

define( 'MCS_API_BASE', 'https://your-instance.com' );
define( 'MCS_API_KEY', 'ck_live_...' );          // needs sessions:write
define( 'MCS_WEBHOOK_SECRET', 'whsec_...' );

/**
 * Create a MyCryptoServer checkout session. Returns the decoded session
 * array (id, checkoutUrl, ...) or null on failure.
 */
function mysite_mcs_create_session( $fiat_total, $reference ) {
	$response = wp_remote_post( MCS_API_BASE . '/api/v1/checkout_sessions', array(
		'timeout' => 20,
		'headers' => array(
			'Authorization'   => 'Bearer ' . MCS_API_KEY,
			'Content-Type'    => 'application/json',
			// Safe to retry on timeouts without creating a duplicate session.
			'Idempotency-Key' => 'mysite-' . $reference,
		),
		'body'    => wp_json_encode( array(
			'amount'     => array(
				// The API accepts at most 2 decimal places.
				'value'    => number_format( (float) $fiat_total, 2, '.', '' ),
				'currency' => 'USD',
			),
			'metadata'   => array( 'reference' => (string) $reference ),
			'successUrl' => home_url( '/thank-you/' ),
			'cancelUrl'  => home_url( '/payment-cancelled/' ),
		) ),
	) );

	if ( is_wp_error( $response ) || 201 !== wp_remote_retrieve_response_code( $response ) ) {
		return null;
	}

	return json_decode( wp_remote_retrieve_body( $response ), true );
}

// Usage:
$session = mysite_mcs_create_session( 49.99, $order_reference );
if ( $session ) {
	// You will need this to match the webhook later.
	update_post_meta( $order_post_id, '_mcs_session_id', $session['id'] );
	wp_redirect( $session['checkoutUrl'] );
	exit;
}

add_action( 'rest_api_init', function () {
	register_rest_route( 'mysite/v1', '/mcs-webhook', array(
		'methods'             => 'POST',
		// Authentication is the signature check inside the callback.
		'permission_callback' => '__return_true',
		'callback'            => 'mysite_mcs_handle_webhook',
	) );
} );

function mysite_mcs_handle_webhook( WP_REST_Request $request ) {
	$raw = $request->get_body();
	$sig = (string) $request->get_header( 'x-webhook-signature' ); // "t=<unix>,v1=<hex>"

	if ( ! preg_match( '/t=(\d+),v1=([0-9a-f]+)/', $sig, $m ) ) {
		return new WP_REST_Response( array( 'error' => 'bad signature' ), 401 );
	}
	list( , $timestamp, $signature ) = $m;

	// Reject stale deliveries (possible replay).
	if ( abs( time() - (int) $timestamp ) > 300 ) {
		return new WP_REST_Response( array( 'error' => 'stale timestamp' ), 401 );
	}

	// HMAC-SHA256 over "<timestamp>.<raw body>" with the whsec_ secret.
	$expected = hash_hmac( 'sha256', $timestamp . '.' . $raw, MCS_WEBHOOK_SECRET );
	if ( ! hash_equals( $expected, $signature ) ) {
		return new WP_REST_Response( array( 'error' => 'bad signature' ), 401 );
	}

	$event      = json_decode( $raw, true );
	$session_id = isset( $event['data']['sessionId'] ) ? (string) $event['data']['sessionId'] : '';

	switch ( $event['type'] ?? '' ) {
		case 'session.paid':
		case 'session.paid_late':
			// Look up the record you stored against $session_id and fulfill it.
			// Must be idempotent — deliveries are retried.
			mysite_fulfill_by_session( $session_id, $event['data']['txHash'] ?? '' );
			break;

		case 'session.underpaid':
			// Partial payment — flag for manual review rather than fulfilling.
			break;

		case 'session.expired':
		case 'session.failed':
			// Mark the pending record as abandoned.
			break;
	}

	return new WP_REST_Response( array( 'received' => true ), 200 );
}

https://your-site.com/wp-json/mysite/v1/mcs-webhook

docker compose -f docker-compose.wp.yml up