7 Lessons from Building a Non-Custodial Crypto Checkout
The easy version of a crypto checkout generates an address, displays a QR code and waits for a transaction. The production version has to answer much harder questions: who controls the money, which network the customer used, whether the amount is correct, when the payment is final, and what the merchant's software should do when any step is repeated. Those questions shaped CRYPT.PE. We set out to…
Building a non-custodial crypto checkout involves answering complex questions about money control, network compatibility, payment finality, and software responses to repeated steps. CRYPT.PE designed payment software to coordinate transactions without becoming custodians of merchant revenue. The payer sends funds on-chain to a wallet configured by the recipient. This architecture decision impacts almost every product and engineering choice downstream.
In a non-custodial flow, the receiving address belongs to the merchant from the start. Payment and settlement are the same on-chain event, removing the platform withdrawal step but leaving responsibility with the merchant. They must configure controlled addresses and ensure the asset and network are unmistakable to the checkout system. Monitoring the network is crucial to prove the expected transfer reached the configured destination.
A wallet address is incomplete without specifying the exact asset and network. USDT on Tron differs from USDT on Ethereum. The checkout system should display the network label alongside the amount and address, not as secondary information. Repeated network selection warnings prevent errors and ensure error-free transfers.
A transaction hash only proves a transaction exists, not that the correct invoice was paid. The matching engine requires a complete expected-payment record containing the recipient address, asset, network, locked amount, creation time, and order identity. This reference survives refreshes and retries, preventing multiple payments from being tied to a single invoice.
The payment's state should be explicit and boring, with a state machine tracking created, detected, confirming, paid, expired, and review states. Webhooks provide a security boundary, requiring HMAC signature verification before processing to prevent tampering and ensure reliable communication.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
