Description
NoHoldPay is a non-custodial cryptocurrency payment gateway for WooCommerce. Your customers pay an address you control, and the funds settle directly into your own wallet. The platform never touches the money: it watches the blockchain, matches each payment to the right order, and advances the WooCommerce order through a signed webhook. No payouts to wait for, no account freezes, and no chargebacks.
This plugin adds NoHoldPay to WooCommerce as a redirect-to-hosted-checkout gateway: when a buyer chooses a NoHoldPay method, the plugin creates a payment through the NoHoldPay Merchant API and redirects the buyer to a secure hosted checkout. Signed webhooks then move the order forward, with an independent server-side re-verification before an order is marked paid.
Why non-custodial matters
Most crypto gateways route customer funds through a pooled hot wallet or an internal balance they control. That is custody, and it can be frozen, hacked, or lost. NoHoldPay is structurally different: it cannot lose, freeze, or run off with money it never holds. Your keys, your coins.
Key features
- Non-custodial by design: customers pay a wallet you own, and funds never pass through the platform.
- Coin groups as payment methods: group coins (for example Stablecoins or Privacy coins) and each enabled group appears as its own payment option at checkout, with an optional logo, a default coin, and a “Restrict to these coins” toggle.
- Many chains and coins through the hosted checkout: Bitcoin, Ethereum, BNB Smart Chain, Base, Polygon, Solana, Tron, Litecoin, Bitcoin Cash, Dogecoin, Monero, XRP, Stellar and TON, plus stablecoins such as USDC, USDT, USDS, EURC and PYUSD, and tokens such as Chainlink. Which coins are available depends on your NoHoldPay account settings.
- Secure hosted checkout: a mobile-friendly checkout with a live countdown, QR code, and real-time status. Prices are shown in your store currency.
- Signed, verified webhooks: orders advance only on HMAC-signed webhooks, with an independent server-side re-check of amount, currency and order binding before an order is marked paid.
- Order status mapping: map NoHoldPay states (awaiting payment, confirmed, underpaid, expired, cancelled, refunded) to your own WooCommerce order statuses.
- Tamper-proof amounts: the charged amount is derived from the order total on the server, never from the browser.
- Works with the classic (shortcode) checkout and the Cart/Checkout Blocks.
- HPOS (High-Performance Order Storage) compatible.
A NoHoldPay account is required (free to create at https://app.noholdpay.com/auth/login?mode=signup), along with your own cryptocurrency wallet to receive funds.
External services
This plugin relies on the third-party service below. It contacts the service only from your web server (never from the buyer’s browser), and only when the relevant feature is used.
NoHoldPay Merchant API (https://api.noholdpay.com)
This is the non-custodial payment processor the plugin integrates with. It is required for the plugin to work. You create a NoHoldPay account and connect it with an API key. The plugin contacts this API in these cases:
- When a buyer places an order with a NoHoldPay method, to create the crypto payment. Data sent: the order total and currency, your store order id, an order description (your order number and store name), the order-received and checkout return URLs (only when those are public URLs), and the buyer’s billing email address when present. Your API key is sent as a bearer credential. No card or bank details are involved.
- When a signed webhook reports a payment as confirmed, to independently re-read that payment and re-verify its amount, currency and order before the order is marked paid. Data sent: the NoHoldPay payment id and your API key.
- On the gateway settings screen, for the “Test connection” button and the coin-catalogue loader. Data sent: your API key.
The API base URL is configurable if you self-host NoHoldPay.
Terms of Service: https://noholdpay.com/legal/terms
Privacy Policy: https://noholdpay.com/legal/privacy
Installation
- Upload the plugin folder to
wp-content/plugins/(or install the zip via Plugins > Add New > Upload Plugin), then activate it. WooCommerce must be installed and active. - Go to WooCommerce > Settings > Payments and enable NoHoldPay, then click Manage.
- Paste your API key (
pk_test_...for testnets,pk_live_...for mainnet). The prefix fixes the mode. - Copy the Webhook URL shown next to the signing-secret field, add it as the webhook endpoint on your API key in the NoHoldPay dashboard, then paste the generated signing secret back into the field. Save.
- Optional: on the same screen, build coin groups. Each enabled group becomes its own payment method at checkout.
Your webhook URL must be publicly reachable over HTTPS.
FAQ
-
Do I need a NoHoldPay account?
-
Yes. Create a free account at https://app.noholdpay.com/auth/login?mode=signup, add your own wallet, and generate an API key. The plugin connects to your account with that key.
-
Where do funds go?
-
Directly to the wallet you configured in your NoHoldPay account. The platform is non-custodial and never holds customer funds.
-
Which cryptocurrencies can I accept?
-
Through the hosted checkout you can accept Bitcoin, Ethereum, BNB Smart Chain, Base, Polygon, Solana, Tron, Litecoin, Bitcoin Cash, Dogecoin, Monero, XRP, Stellar and TON, plus stablecoins such as USDC, USDT, USDS, EURC and PYUSD, and tokens such as Chainlink. The exact set depends on which chains and coins you have enabled in your NoHoldPay account.
-
Does it work with the block checkout?
-
Yes. Both the classic (shortcode) checkout and the Cart/Checkout Blocks are supported.
-
What data does the plugin send, and where?
-
See the “External services” section above. In short: order data (total, currency, order id, description, and the buyer’s email) is sent to the NoHoldPay Merchant API to create and verify payments. Coin logos in the admin coin-group builder are bundled with the plugin (no third-party icon host). No card or bank data is handled by your site.
-
The webhook is rejected with an invalid-signature error
-
The most common cause is server clock skew. The webhook timestamp must be within the tolerance (default 300 seconds) of your server clock. Sync the server time (NTP). You can raise the tolerance in the gateway settings only as a last resort.
-
Checkout shows “We could not start the crypto checkout”
-
This means the NoHoldPay API declined to create the payment. Turn on Debug logging in the gateway settings to see the exact reason inline, or open WooCommerce > Status > Logs and read the newest
noholdpaylog. Two common causes: the order total is below the minimum invoice amount for every enabled chain (raise the total or enable a cheaper chain), or the store is on a local/private host so the return URLs are not public (the payment still starts, but the buyer is not redirected back automatically).
Reviews
There are no reviews for this plugin.
Contributors & Developers
“NoHoldPay – Non-custodial crypto payments” is open source software. The following people have contributed to this plugin.
Contributors
Translate “NoHoldPay – Non-custodial crypto payments” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.1
- Renamed all internal function, class, constant, option, script handle, AJAX action, and nonce identifiers to use the full noholdpay prefix (WordPress.org plugin directory requires prefixes longer than four characters). No configuration changes are needed.
1.1.0
- Coin-group builder redesigned with a searchable, icon-based coin picker (coin logos bundled under assets/icons/).
- Official NoHoldPay branding on the settings screen and the checkout method.
- Documentation links added to the settings screen.
- Block checkout now honours each coin group’s own enable toggle.
- Added the External services disclosure and other WordPress.org readiness fixes (input sanitisation, plugin headers).
- Fix: a store on a local or private host (for example a LocalWP site at localhost) could not start the crypto checkout because the redirect URLs were rejected as non-public. Those optional URLs are now omitted on such hosts so the payment still starts.
1.0.0
- Initial release.