Scuntra for WooCommerce

Description

Scuntra for WooCommerce lets your store take crypto payments with a drop-in gateway:

• 9 currencies — BTC, LTC, BCH, XMR, ETH and TRON, plus USDT (TRC-20 and ERC-20) and USDC (ERC-20). If you accept more than one, the customer picks at checkout.
• Hosted invoice page — the customer is redirected to a secure Scuntra invoice with a live QR and status. Nothing sensitive touches your store.
• Automatic order completion — when the payment reaches the required confirmations, Scuntra sends a signed webhook and the order flips to Processing/Completed on its own.
• HMAC-verified webhooks — every callback is verified with HMAC-SHA256 against your per-store secret (timestamp + nonce + body), with a 5-minute replay window.
• Live FX conversion — the order total in your store currency is converted to the chosen coin at checkout using Scuntra’s live ticker.
• No KYC — funds settle to wallet addresses you nominate. Scuntra never asks for your customers’ identity.

This plugin talks to the Scuntra REST API. You need a Scuntra account (free) to get an Account ID and Webhook signing secret.

External services

This plugin connects to the Scuntra API to create and settle cryptocurrency payments. The
connection is required: without it there is no invoice for a customer to pay. The API host is
configurable in the plugin settings and defaults to https://scuntra.com.

Three interactions take place:

1. Exchange rate, at checkout. When a customer selects a coin, the plugin requests the
   current rate with GET {host}/api/v2/ticker?currency={coin}&fiat={store currency}. Only the coin
   code and your store’s currency code are sent. No order or customer information is included.

2. Invoice creation, when an order is placed. The plugin sends POST
{host}/api/v2/accounts/{your account id}/invoices containing: the chosen coin, the converted
   amount, the invoice lifetime, the WooCommerce return URL for that order, your store’s webhook URL,
   your site name, the order number and the order ID. An idempotency key derived from the order ID,
   order total and coin is sent as a header so a retry cannot create a duplicate invoice.

3. Payment notification, after the customer pays. Scuntra calls your store’s webhook URL. The
   plugin verifies an HMAC-SHA256 signature against your signing secret and updates the order. Nothing
   leaves your store during this step.

Customer personal data is never sent to Scuntra by this plugin — no names, email addresses,
billing or shipping addresses, and no card or wallet credentials. The customer pays on Scuntra’s
hosted invoice page, which is why nothing sensitive passes through your store.

Using this plugin means your store relies on the Scuntra service, governed by:

• Terms of Service: https://scuntra.com/terms
• Privacy Policy: https://scuntra.com/privacy