Xcash for WooCommerce

Overview Xcash for WooCommerce enables merchants to accept crypto payments through the Xcash payment gateway. Customers complete payments on Xcash’s hosted checkout while WooCommerce stays in sync via secure webhooks. The gateway works with both classic shortcodes and WooCommerce Checkout Blocks, supports fiat-denominated invoices, and offers bilingual (English/Chinese) strings out of the box. Features

• Seamless Xcash gateway integration for WooCommerce orders with automatic redirect to the hosted pay_url.
• Fiat-denominated invoices (USD, CNY, EUR, JPY, HKD) with Xcash-managed crypto conversion.
• Optional JSON-based methods filter to limit coin-chain combinations presented to shoppers.
• Built-in “Test Configuration” button to validate credentials without placing a live order.
• Hardened webhook handler with nonce and per-invoice idempotency plus HMAC-SHA256 signature verification.
• Compatible with WooCommerce Checkout Blocks, High-Performance Order Storage (HPOS), and PHP 7.4–8+.
• Includes English and Simplified Chinese translations for admin and frontend strings.

Requirements

• WordPress 5.8 or higher.
• WooCommerce 5.0 or higher (tested up to WooCommerce 10.9).
• PHP 7.4 or higher.
• Active Xcash merchant account with App ID and HMAC key.

How It Works

1. Shopper chooses “Xcash” during checkout.
2. The plugin creates an invoice through the Xcash API using a bounded unique WooCommerce order reference as out_no and the order's WooCommerce currency as the pricing currency.
3. Customer is redirected to the Xcash-hosted payment page (pay_url) to finalize the crypto transfer.
4. Xcash notifies the store via webhook once the payment is detected and confirmed.
5. The order is automatically marked as paid and annotated with invoice/transaction details.

External Service This plugin connects to Xcash, a cryptocurrency payment gateway, to create hosted crypto checkout invoices and receive payment status notifications. Xcash service information is available at https://xca.sh, developer documentation is available at https://docs.xca.sh, the Xcash Terms of Service are available at https://xca.sh/terms/, and the Xcash Privacy Policy is available at https://xca.sh/privacy/. The merchant must create an Xcash account at https://dash.xca.sh and enter the project App ID and HMAC key in the WooCommerce gateway settings. The gateway URL defaults to https://pay.xca.sh and can be changed if the merchant runs their own compatible Xcash gateway. When a shopper places an order with this payment method, or when an administrator uses the “Test Configuration” button, the plugin sends a signed HTTP(S) request to the configured Xcash gateway invoice API (https://pay.xca.sh/v1/invoice by default). The request includes authentication headers (XC-Appid, XC-Nonce, XC-Timestamp, and XC-Signature) and an invoice JSON body containing the WooCommerce order reference (out_no), order title, order total amount, pricing currency, invoice duration, the store return URL, the store webhook notification URL, and optional merchant-configured payment method restrictions. After the invoice is created, the shopper is redirected to the hosted Xcash payment URL returned by the service. When Xcash detects and confirms payment, Xcash sends a signed webhook request back to the store. The plugin validates the signature and stores invoice/payment identifiers and transaction details from the webhook, such as Xcash invoice ID (sys_no), merchant order reference (out_no), confirmation flag, cryptocurrency, payment amount, pay address, transaction hash, chain, and block number, as WooCommerce order metadata and displays the core fields on the admin order screen. Gateway Configuration

• Navigate to WooCommerce → Settings → Payments → Xcash and enable the gateway.
• Set the title/description displayed to customers.
• Enter your Xcash App ID and HMAC Key from the Xcash console.
• Keep the default gateway URL (https://pay.xca.sh) or change it to your own compatible gateway.
• The invoice pricing currency is taken automatically from your WooCommerce store currency, so make sure it is a fiat currency supported by Xcash.
• Optionally specify allowed payment methods as JSON — e.g. {"USDT":["ethereum","tron"]}.
• Adjust the payment duration (5–30 minutes, default: 20 minutes) if needed.
• Use the “Test Configuration” button to confirm the credentials before going live.

Webhook & Security

• Webhook endpoint: https://your-site.com/?wc-api=xcash_webhook.
• The plugin sends this endpoint automatically as the invoice-level notify_url when creating invoices.
• Every webhook is validated by checking the XC-Appid, XC-Nonce, XC-Timestamp, and XC-Signature headers.
• Nonces are stored as transients and each paid invoice is marked as processed to block replay attempts; the request timestamp is covered by the HMAC signature rather than checked against a fixed time window.
• Detailed debug logs are written through WooCommerce’s logging system (wc_get_logger).

Localization

• Text Domain: xcash-for-woocommerce.
• Domain Path: /languages.
• Bundled translations: English (default) and Simplified Chinese.

Compatibility

• WooCommerce Checkout Blocks integration via Xcash_WC_Gateway_Blocks_Support.
• Declares compatibility with WooCommerce High-Performance Order Storage (custom order tables).
• Supports both shortcode-based and block-based checkout flows.

1.0.8

• Moved the gateway settings "Test Connection" script and styles into separate files loaded with wp_enqueue_script()/wp_enqueue_style() instead of inline markup.
• Limited the "WooCommerce required" admin notice to the Plugins screen so it no longer appears across the admin dashboard.
• Renamed the bundled gateway icon to assets/images/xcash-icon.png and removed WordPress.org directory artwork from the plugin package.

1.0.7

• Added core Xcash payment details to the WooCommerce admin order screen.

1.0.6

• Removed the read-only webhook URL display from the WooCommerce gateway settings because invoices now send the store callback endpoint as notify_url automatically.
• Changed the default invoice payment duration to 20 minutes.

1.0.5

• Added a configurable Xcash gateway URL setting, defaulting to https://pay.xca.sh.
• Refreshed bundled Simplified Chinese translations and included the runtime .mo language pack.

1.0.4

• Fixed invoice creation failing when the Xcash API returns HTTP 201; both 200 and 201 are now treated as a successful response.
• The invoice pricing currency now follows the WooCommerce store currency instead of a separate setting, so the amount and currency always match.
• Webhook notifications delivered after a delay (retries) are no longer rejected by a timestamp window; replay protection is preserved via the signed nonce.

1.0.3

• Initial release with WooCommerce payment gateway integration for Xcash, webhook handler, credential testing, block-based checkout support, and bilingual strings.