Accept cryptocurrency and stablecoin payments (USDC, USDT and more, multi-chain) in Ecwid by Lightspeed through Payzum — non-custodial: funds settle directly to your own wallet, Payzum never takes custody. No chargebacks, no card networks, no PCI surface.
- App:
payzum/ecwid-gateway· Version: 1.0.0 · License: MIT - Type: self-hosted Ecwid custom payment app (PHP ≥ 8.1,
ext-curl) - Requires: an Ecwid store with custom-app access, a Payzum merchant account
Ecwid is a hosted platform, so this integration is not a droppable plugin: it is a small self-hosted PHP app that Ecwid calls at checkout via its Payment API. The official
payzum/payzum-phpSDK ships vendored — no composer step needed on the server.
- At checkout Ecwid POSTs an encrypted payment request to
payment-request.php. The app decrypts it (AES-128-GCM, keyed from your appclient_secret), creates a Payzum invoice, and redirects the buyer to the hosted Payzum checkout (QR code + deposit address), where they choose the coin and chain and send the payment. No wallet or card data touches your server. - Crypto confirmation is asynchronous, so the order is marked
PAID(via the Ecwid REST API) from Payzum's signed server-to-server IPN webhook, never from the buyer's browser return — a closed tab never loses a paid order. - Every webhook is verified with HMAC-SHA-512 over the raw request bytes
(constant-time compare, replay window) before a single field of it is read,
and the amount and currency are re-checked against what the invoice was
created for. Redelivered webhooks are a no-op, and a late
expireddelivery can never cancel an order that was already paid.
- Stablecoin-first: USDC and USDT across multiple chains (Polygon, Ethereum, Arbitrum, Base, Optimism, Tron, Solana and more), plus major cryptocurrencies.
- Non-custodial — payments settle to the merchant's own wallet.
- Hosted checkout — no card fields, no crypto handling, no PCI scope. The buyer picks the coin on the Payzum checkout, limited to your merchant allowlist and enforced server-side.
- Amount verification on settlement — the IPN must match the amount and currency the invoice was created with, not just carry a valid signature.
- Hardened credential storage — the order-mapping store (which holds the
Ecwid OAuth token) must live outside the docroot; both endpoints refuse to
start otherwise, and the directory is created
0700with.htaccessandindex.htmlguards. - Zero chargebacks — crypto payments are final.
-
Register a custom payment app in the Ecwid Developers portal with
paymentUrl=https://your-app/payment-request.php. -
Get the files — download
payzum-ecwid-1.0.0.zipor clone this repository — host them on any PHP ≥ 8.1 server, then:cp config.sample.php config.php # config.php is git-ignored — never commit secrets -
Fill in
config.php(see the sample for full documentation of each key). -
In your Payzum dashboard, set the webhook to
https://your-app/ipn.php.
| Key | Meaning |
|---|---|
ecwid_client_secret |
Your Ecwid app's client_secret — decrypts the checkout payment request |
payzum_api_key |
From your Payzum merchant dashboard |
payzum_webhook_secret |
Verifies incoming payment webhooks (IPN) |
payzum_environment |
production or staging (staging needs its own API key) |
base_url |
Public base URL of this app — used to build the IPN callback URL |
data_dir |
Absolute path outside the docroot for the order-mapping store; the app refuses to start if it resolves inside the app directory |
There is deliberately no pay-currency setting (the buyer picks the coin on the hosted checkout) and no signature-header setting (the SDK owns the fixed header).
| Payzum payment status | Ecwid order |
|---|---|
finished (amount and currency matching) |
PAID |
expired, failed |
CANCELLED — unless the order already settled, which a late terminal event never touches |
partially_paid, waiting |
No-op — the order stays awaiting payment; a later finished marks it PAID |
Can an Ecwid store accept USDT or USDC? Yes — with this app, buyers pay in USDC, USDT or other supported assets on the chain they prefer, and the order is marked paid automatically.
Is Payzum custodial? No. Funds settle directly to your own wallet — Payzum never holds your money.
Do buyers need an account or a specific wallet? No. They scan a QR or copy a deposit address from the hosted checkout and pay from any wallet.
What about chargebacks? There are none — crypto payments are final, which eliminates chargeback fraud.
Why is this self-hosted?
Ecwid's Payment API calls an external paymentUrl you host, so the integration
runs as your own small PHP app rather than something installed inside Ecwid.
What data is shared with Payzum?
Only the order total, currency, an order reference and the app's callback
URL — no customer personal data. Endpoints: https://merchant.payzum.com
(production), https://staging.payzum.com (staging).
Payzum ships official plugins for most major e-commerce, donation and billing platforms — WooCommerce, Magento 2, PrestaShop, Shopware 6, OpenCart, Zen Cart, nopCommerce, BigCommerce, Shopify, Wix, Medusa, Vendure, Saleor, Sylius, Easy Digital Downloads, GiveWP, Paid Memberships Pro, WHMCS, Blesta, HostBill, ClientExec, pretix, Frappe/ERPNext, Akaunting and django-payments — plus official SDKs for PHP, Node.js/TypeScript, Python and Rust. Browse them all at github.com/payzum-dev.
Payzum is a non-custodial crypto payment gateway for merchants: accept USDC, USDT and other digital assets with settlement straight to your own wallet, optional auto-conversion to stablecoins, and a single REST API. API docs: merchant.payzum.com/api/docs.
MIT. Contributed and maintained by Payzum.