Accept a crypto payment using a payment processor webhook with confirmation and underpayment handling

Verified steps

1. Create a charge or payment request via your chosen processor's API (e.g., POST /charges) specifying 'name', 'description', 'pricing_type' ('fixed_price' recommended for commerce), and 'local_price' with 'amount' and 'currency' in your base fiat currency — the processor converts to crypto equivalents.
2. Redirect the customer to the hosted payment page URL in the response, or use the embedded widget; the processor generates a unique deposit address per charge.
3. Subscribe to webhook events; when a webhook arrives, verify the authenticity by computing HMAC-SHA256 of the raw request body with your shared webhook secret and comparing to the 'X-CC-Webhook-Signature' (or equivalent header).
4. Listen for confirmation-stage events: most processors emit events like 'charge:pending' (transaction broadcast to mempool), 'charge:confirmed' (meets confirmation threshold), and 'charge:failed'; only fulfill orders on 'confirmed' events.
5. Handle underpayments: if the customer sends less than the required amount, the charge enters an 'UNDERPAID' state — expose this to the customer and allow them to top up, or issue a refund via your processor's dashboard; do not fulfill partial payment as full.
6. Set an expiration window (typically 15–60 minutes) on charges; if the charge expires before payment is received, create a new charge with updated crypto-equivalent amounts to account for price movement.