QBitFlow for WooCommerce

Sign up at qbitflow.app and generate an API key from your dashboard.

ETH, SOL, USDC, USDT, and more. The plugin settings list the currencies your wallets accept; the QBitFlow dashboard has the full list.

No. QBitFlow is fully non-custodial. Payments go directly to your wallet via smart contracts.

Yes. The plugin supports both the classic shortcode checkout and the WooCommerce block-based checkout.

It registers your store's webhook address with QBitFlow (for the mode of your API key) and stores the signing secret QBitFlow returns, so payment and refund notifications reach your store and are verified there. If your API key is a member key that isn't allowed to manage webhooks, create the endpoint in the QBitFlow dashboard with the address shown in the settings and paste its signing secret into "Webhook signing secret". Even without a webhook, the plugin checks unpaid orders every 15 minutes.

Yes. A key of a QBitFlow member space works like the organization's, with the limits the organization sets (the processing fee shows read-only). If the organization turned off the members.checkoutRedirects policy, QBitFlow refuses checkouts that carry return addresses: the plugin then retries once without them (the customer pays, and the order is completed by the webhook or the 15-minute check, but is not sent back to your store automatically), remembers it for an hour and shows a notice in the admin. Ask the organization to turn the policy back on to bring the customer back to your store after payment.

In your QBitFlow dashboard. Refunds on or off, the refund window, customer receipt emails, webhook failure emails, the processing fee default and branding are settings of your QBitFlow account, shared by every store and integration using it, so they are not edited from WordPress.

QBitFlow prices checkouts in USD. For any other store currency, QBitFlow stays hidden at checkout until a USD exchange rate is provided with the qbitflow_wc_usd_rate filter (from a multi-currency plugin or your own code), so a customer is never charged the wrong amount: add_filter( 'qbitflow_wc_usd_rate', function ( $rate, $currency ) { return 'EUR' === $currency ? 1.08 : $rate; }, 10, 2 );

You choose in the settings (Processing fee). Use my QBitFlow setting (default) follows the processing fee default set in your QBitFlow dashboard: the plugin sends no choice and QBitFlow applies it (the fee then shows on the QBitFlow checkout only). Customer pays adds QBitFlow's fee as a last line on the QBitFlow checkout, so you receive the full order total; the customer pays slightly more than the order total and the fee is recorded on the order. Store pays takes the fee from what you receive. A member key always follows its organization.

Yes: Accounting export in the settings (CSV or JSON, any range of days, in UTC), or wp qbitflow export --from=2026-01-01 --to=2026-01-31 --output=jan.csv. It covers your whole QBitFlow account (or your member space), not only this store's orders.

Refunds are sent from the QBitFlow dashboard, where your wallet signs them: customers request one from their payment page and you approve or reject it, or you send one yourself. The plugin records each approved refund in WooCommerce automatically (a partial refund for its share), notes requests and rejections on the order, and shows how many requests wait for you. WooCommerce's own "Refund via QBitFlow" button isn't offered, since crypto refunds can't be sent from WooCommerce.

Yes! Create a Test API Key from your QBitFlow dashboard and use it in the plugin settings. You can simulate the entire payment flow without spending any cryptocurrency (test checkouts are capped at $5). See the Test Mode Documentation for details.

Test API keys will not process real transactions. The settings show a Test/Live badge for your key; replace your test key with a live key (and connect the webhook again) before launching your store.

1. Create a new API key in the QBitFlow dashboard (2.0 uses the new key format, sk_live_… or sk_test_…; the old format is refused by the API) and paste it in the settings.
2. Click Connect webhook (a notice reminds you): 2.0 verifies webhooks with a signing secret, so the webhook you registered by hand for 1.x no longer applies, and you can delete it from the QBitFlow dashboard.

CVE-2026-109618 and CVE-2026-109619 are flaws in PHP itself, fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Only upgrading PHP fixes them: ask your host. If your PHP comes from your Linux distribution, it may carry the fixes under an older version number; check its security advisory. Tools → Site Health shows the details.