FAQ

Why must I verify the webhook signature before doing anything?

Because the endpoint URL is public the moment you register it, so anyone can POST arbitrary JSON to it. The HMAC signature is the only thing that distinguishes a real halfin event from a forged one. Recompute the HMAC over the exact raw bytes with the endpoint's signing secret, compare it to the header in constant time, and only then parse and act. A mismatch is hostile input — return a 4xx and do nothing else.

Keep reading across the cluster.

Crypto payment integration best practicesThe habits that keep a crypto integration safe and reconciled Guides questionsFrequently asked questions drawn from the halfin guides pages. Each one links to a standalone answer.Can a customer charge back a crypto payment?No — not in the card sense. A card chargeback is a forced reversal initiated by the issuing bank, who can pull settled funds back out of your account…Can a leaked API key drain my balance the way a stolen hot-wallet key would?Only if it is the wrong key and your process allows it. A read-only or invoicing-scoped key cannot initiate a payout at all. A leaked payouts-scoped key…Can halfin cash my USDC out to a bank account?No. halfin is digital-asset payment infrastructure, not a fiat off-ramp — it does not sell USDC to a bank account. The USDC you collect sits in a balance…Can halfin convert my crypto balance to dollars in a bank account?No. Every conversion is asset-to-asset and stays on-chain — for example native SOL into USDC, or ETH into USDT. halfin is not a fiat off-ramp and does not…Can halfin convert my crypto to fiat and send it to my bank?No — halfin does not cash out to a bank. It converts between the crypto assets you hold on the platform, including settling volatile assets into a…Can halfin pay affiliates out to a bank account?No. A payout sends a crypto asset to a crypto address; halfin has no fiat off-ramp and does not move money to a bank. Balance conversion can rebalance…Can I accept both native ETH and ERC-20 tokens like USDC or USDT?Yes. 'Ethereum' covers native ETH and ERC-20 tokens on the same network, and halfin treats each asset as its own settlement rail. You choose which to…Can I auto-charge a customer's wallet every month like a saved card?No, and no crypto payment system can for a self-custody wallet — a wallet does not delegate standing authority to pull funds the way a card network lets a…Can I avoid network fees entirely?No — any transaction on a public blockchain pays the network for block space; that is how the chain is secured. What you can do is choose the rail…Can I build my integration before KYB is complete?Yes — and you should. Verification gates live transacting, not development. Use the sandbox to create invoices, simulate payments, and exercise your…