=== Coinvay Payments ===
Contributors: coinvay
Tags: woocommerce, cryptocurrency, payment gateway, bitcoin, payments
Requires at least: 6.6
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.2.2
License: MIT
License URI: https://opensource.org/license/mit/

Accept crypto through Coinvay hosted checkout, with direct-to-wallet settlement and automatic supported-currency to USD pricing.

== Description ==

Coinvay Payments connects WooCommerce to the Coinvay hosted crypto payment service. Customers open a hosted checkout, select a supported coin/network and send payment to the merchant's configured receiving wallet. Coinvay verifies blockchain confirmation; this plugin checks the matching invoice before updating the WooCommerce order.

The plugin code is free and included in full. A Coinvay merchant account and configured receiving wallets are required. Coinvay offers Free, Pro and Enterprise service plans. Service features, API-key/invoice allowances and any subscription prices are shown at https://coinvay.com/pricing. Blockchain network fees are separate. Installing this plugin does not purchase a plan or enable customer checkout automatically.

Features:

* Classic WooCommerce checkout and Checkout Blocks registration.
* Settings shortcut on the Installed Plugins page.
* Manual API-key setup or explicit account authorization through Connect to Coinvay.
* Store-specific business name, logo and payment webhook.
* Supported WooCommerce order currencies are priced in USD at invoice creation; original and locked USD totals are checked before order completion.
* Authenticated invoice reconciliation, signed webhooks on eligible Coinvay plans and background polling.
* HPOS order API compatibility declarations.

Crypto/network availability depends on Coinvay's current supported contracts, the merchant's configured receiving wallets and provider availability. Payment confirmation is not guaranteed to be instant. No seed phrase or wallet private key is required by this plugin. Customers approve their own payments.

This plugin handles one-time orders. Automatic refunds and WooCommerce Subscriptions recurring debits are not included. Refunds require the merchant's separate wallet transfer and order bookkeeping.

= External service and privacy =

This plugin uses the Coinvay API at https://coinvay.com to create and verify hosted invoices, authorize account connections and store checkout branding. A configured HTTPS Coinvay origin can be used for an independently hosted compatible gateway.

After an administrator configures/authorizes the service, the plugin sends the store URL, installation identifier, callback/webhook URLs and selected business name/logo when connecting or saving branding. Automatic authorization requires the administrator to sign in to Coinvay and approve the displayed store and permissions. Credentials remain on the WordPress backend; automatic connection credentials are encrypted using the installation's authentication salt.

When an order is paid through this gateway, the plugin sends its order reference, trusted amount/currency and billing name/email when available to Coinvay. It receives an invoice ID, hosted checkout URL and payment status. Coinvay hosts the customer's payment screen. The plugin verifies signed notifications and/or polls the invoice to reconcile the saved order. Successful browser navigation alone never marks an order paid.

The plugin does not include analytics/advertising pixels, does not collect wallet private keys and does not insert a tracking script on the store. Coinvay service terms and privacy information:

* Terms: https://coinvay.com/terms
* Privacy: https://coinvay.com/privacy
* Acceptable use: https://coinvay.com/aml
* Service pricing: https://coinvay.com/pricing

Store owners are responsible for their own customer privacy notices, lawful use, receiving wallet configuration and fulfillment. Coinvay branding is shown on its hosted checkout.

== Installation ==

1. Back up and test on a staging installation. Use WordPress 6.6+, WooCommerce 9.5+, PHP 8.1+, HTTPS and MySQL/MariaDB supporting GET_LOCK/RELEASE_LOCK.
2. Install and activate Coinvay Payments. WooCommerce must be active.
3. Open Plugins > Installed Plugins > Coinvay Payments > Settings, or WooCommerce > Settings > Payments > Coinvay.
4. Choose Manual API key or Connect to Coinvay. For automatic setup, sign in/register on Coinvay, review the store origin and explicitly authorize the connection. Plan API-key limits apply.
5. Configure and confirm your receiving wallets in Coinvay. Save the checkout business name and optional PNG/JPG/WebP logo (up to 2 MB) in the plugin.
6. Test a staging order, payment confirmation and fulfillment before enabling the Coinvay payment method for customers. Signed webhooks require an eligible service plan. Polling also runs through WP-Cron; configure a real server cron for reliable background reconciliation.

== Frequently Asked Questions ==

= Does Coinvay hold the payment? =

Invoice payments go directly to the merchant's configured receiving wallet. Coinvay verifies the blockchain transfer. There is no Coinvay-held withdrawal balance in this invoice flow.

= Where is setup? =

Click Settings beside Deactivate on the Coinvay Payments row under Installed Plugins. The page contains manual/automatic connection controls and checkout branding fields.

= Is an account required? =

Yes. The external Coinvay service provides hosted checkout and verification. Its current service-plan features and limits apply. The local plugin code is available in full.

= Are order currencies converted? =

Supported source currencies are priced in USD when Coinvay creates the invoice. The USD amount is locked for that invoice; the merchant receives the cryptocurrency selected by the customer. This is price calculation, not a fiat conversion/remittance service.

= When is an order paid? =

After Coinvay verifies the required blockchain confirmations and the plugin retrieves a matching Paid invoice. Pending, failed, cancelled or mismatched evidence does not complete an order.

= Can I run multiple stores? =

Each connected store has its own checkout identity, webhook and scoped key. Automatic connections consume the current plan's API-key allowance. Legacy manual keys keep their full merchant permissions. Disconnect/reconnect controls do not erase historical payment records.

= Does this support automatic refunds or recurring debits? =

No. This module handles one-time invoices. Those flows require separate merchant-approved transfers or billing integration.

= How are credentials protected? =

Automatic credentials are encrypted with the installation's WordPress authentication salt and remain on the server. Preserve that salt in protected backups; changing it requires reconnecting. Manual keys are stored in the protected WooCommerce gateway settings. Never place them in browser or mobile code.

== Changelog ==

= 1.2.2 =
* Add a permission-aware Settings shortcut beside Deactivate.
* Add WordPress.org directory documentation and external-service disclosures.
* Use WordPress HTTP in bundled SDK transports; validate callback/header inputs and allow only the configured authorization redirect host.

= 1.2.0 =
* Add explicit store account authorization and encrypted automatic credentials.
* Add store-specific checkout branding and webhooks.

= 1.1.0 =
* Add supported source-currency forwarding and locked USD order matching.

== Upgrade Notice ==

= 1.2.2 =
Adds direct setup access from Installed Plugins. Existing receiving wallets and payment records are retained.
