365Payments
365 Networking

365 Networking · Payments

One address per payment, one signed answer.

365Payments is built around one flow. A merchant's server asks for a payment and receives a one-time Monero address for it. After ten confirmations the whole payment is swept to the merchant's own address, and the merchant is told by a webhook signed under the merchant's own secret.

Money that moves once, to the address it belongs to.

The flow Status

Built The flow is written and was tested on earlier servers that are no longer in service; it is not running today. There is no card processing and no payout service.

Drawn by ImageForge, our own image engine

The flow Built

From a request to a signed answer

Five steps, each one visible in the code, none of them taking a shortcut.

  1. A payment is asked for

    The merchant's server calls the payments API with its key and receives a one-time address, the amount in Monero and a payment link. The record waits as pending for up to 24 hours.

  2. The customer pays

    The checkout page follows the payment with a token that is good for that one transaction, stored only as a SHA-256 hash. The merchant's key never reaches the browser.

  3. The chain confirms

    Every 30 seconds the platform reads the transfers to that address. Nothing moves before ten confirmations, about twenty minutes.

  4. Swept to the merchant

    The whole balance of the one-time address is swept to the address the merchant registered.

  5. Told, and signed

    The merchant receives a webhook whose body is signed with HMAC-SHA256 under the merchant's own secret, so the merchant can check it before trusting it.

The Monero payment flow as built: the merchant server asks the payments API for a payment; the API creates a one-time address and a pending record; the checkout page follows it with a one-transaction token; the customer's wallet pays the one-time address; every 30 seconds the platform reads the transfers; after ten confirmations the whole balance is swept to the merchant's own address and a webhook signed with HMAC-SHA256 tells the merchant server Merchant server keeps its API key Payments API checks the key Payment record pending, 24 hours One-time address one per payment Checkout page one-payment token Customer wallet pays the address Every 30 seconds transfers read for that address Ten confirmations about twenty minutes Whole balance swept once Webhook HMAC-SHA256 signed Merchant's address Merchant server
The flow as built. It is not running today.

What is signed, and where secrets stay

Every hand-off carries its proof

API key
Stays on the merchant's server; the browser never sees it.
Checkout token
Good for one transaction, and stored only as a SHA-256 hash.
Address
A fresh one-time address for every payment, so one payment is never mistaken for another.
Settlement
After ten confirmations, the whole payment to the merchant's own address. Not instant, and not before the chain has confirmed it.
Webhook
The body signed with HMAC-SHA256 under the merchant's secret; the merchant verifies it before acting on it.

Status

What is built, and what is not

  • Built Built

    The Monero flow above: the request, the one-time address, the confirmation count, the sweep and the signed webhook. It was tested on earlier servers that are no longer in service.

  • Not offered

    No card processing, no payouts and no other currency. Nothing on this site takes a payment today.

365 Networking

Separate engines, one house