Signed, idempotent, and safe by default.
Last updated: July 20, 2026
Every deposit invoice fires an IPN to /api/public/nowpayments-ipn. Payloads are HMAC-verified against the store's IPN secret and stored in an event ledger so a duplicate delivery cannot double-credit an activation.
Every event carries a payment id we claim atomically. Retries land safely — the second delivery is acknowledged with a 200 but ignored for accounting purposes.
POST /api/public/nowpayments-ipn
x-nowpayments-sig: <hmac-sha512>
{
"payment_id": "...",
"payment_status": "finished",
"pay_currency": "usdtbsc",
"actually_paid": 125.0,
"order_id": "..."
}