A PHP integration should create Coinvay invoices on the server, redirect customers to hosted checkout and verify settlement before updating the local order. The PHP source kit provides a starting point, not automatic deployment to your hosting account.
Keep the payment request server-side
Store the merchant API key in a protected environment setting or private configuration outside the web root. Your checkout controller should load a product from the server catalog and calculate the final USD total. Use an HTTPS client with certificate validation, explicit timeouts and JSON error handling to call POST /api/invoices. Send the bearer key in the Authorization header rather than the URL, where logs and browser history can expose it.
Save an invoice mapping
For a consulting booking priced at 120.00 USD, insert a pending local order and create its invoice with a stable Idempotency-Key. Store the returned invoice ID, original total and expected customer reference. Resolve checkoutPath against the configured Coinvay origin before redirecting. If invoice creation times out, reuse the same key rather than allowing a page reload to produce another request. Never treat a query parameter such as paid=true as confirmation.
Add reconciliation and a controlled launch
Implement authenticated invoice lookup or signed webhook verification, depending on plan availability. PHP webhook code needs the raw input body for signature validation before decoding JSON. Use database transactions and unique constraints so callback and cron jobs cannot fulfill twice. Review the integration kit guide, configure a real scheduled worker on your host and test with a staging database. The merchant Sandbox can demonstrate checkout and testnet verification, but the live PHP API key is not a sandbox API credential.
Practical checklist
- Protect API credentials and disable verbose secret-bearing request logs.
- Verify trusted totals and store the invoice ID before redirecting the buyer.
- Test timeouts, duplicate callbacks, unpaid invoices and failed product delivery on staging.
Common questions
Can I paste the API key into an HTML form?+
No. HTML and client-side JavaScript are visible to visitors. A PHP backend should hold the key and expose only your own limited order endpoint.
Does downloading the PHP kit configure my server?+
No. Your developer must configure hosting, secrets, database persistence, scheduled reconciliation and your own catalog or fulfillment behavior.
Sources and further reading
Primary references and Coinvay product documentation. Check the linked pages for current details.
AI-assisted drafting, published by Coinvay. Examples are illustrative. Read our editorial approach.