CoinGate Crypto Payments — setup and reference

Module and release scope

This guide covers CoinGate Crypto Payments 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.

Open System → Payment gateways (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.

Exact connection fields

These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.

Key / label	Type	Required	Default / guidance
mode — Environment	select	Yes	Default: "sandbox" Choices: sandbox = Sandbox, live = Live
api_token — API app token	secret	Yes	Use a separately generated sandbox or live merchant API app token.
callback_secret — Callback authentication secret	secret	Yes	Choose a long random private secret. Per-order callback tokens are derived from it automatically.
receive_currency — Settlement currency	text	Yes	Default: "EUR" A settlement currency supported by your account. This never changes the invoice amount or currency.

Create a merchant API app in CoinGate or its separate sandbox. Use its API token and choose a supported settlement currency (for example EUR); settlement currency does not change the original invoice price. Configure a random callback authentication secret at least 32 characters long. The module creates an individual HMAC-derived callback token for each order and supplies it to CoinGate. Test calls GET /v2/auth/test.

Supported fiat invoice currencies: USD EUR GBP AUD CAD CHF NZD PLN CZK DKK NOK SEK RON BRL ZAR TRY, subject to your provider account. Crypto choice and any settlement conversion are handled on CoinGate’s hosted page, against the fixed fiat invoice price.

The callback URL is submitted on every order. Both form and JSON callbacks are supported. The callback token is checked, then the authenticated order is fetched and must have status paid. Confirming, partial/refund/invalid/cancelled statuses do not settle. Browser return/reconciliation retrieves the server-stored CoinGate order ID.

Sources: https://developer.coingate.com/reference/api-authentication https://developer.coingate.com/reference/create-order https://developer.coingate.com/reference/get-order https://developer.coingate.com/reference/api-callbacks https://developer.coingate.com/reference/order-statuses

Install and configure

This is an API 1 payment module for the current product source (core 1.3.6). It installs disabled and contains no account credentials. In Payments → Available, open this provider, enable its module after reviewing it, then add a merchant account. Save credentials, run Test and explicitly enable the account. Merchant onboarding and payment-method approval remain with the provider.

Only the listed invoice currencies are supported, using exact two-decimal amounts. Domain/storefront currency is not silently converted. The hosted provider page chooses methods available for the merchant, payer and country. The application never collects a card number or CVV.

The account’s full webhook URL is shown after saving. Register that one HTTPS URL for every storefront sharing the account. Browser success messages never mark an invoice paid. Pending, declined, partly paid, authorization-only and refunded payments require their actual provider state; no automatic refund is requested. Test uses authentication/read-only metadata, never a charge. API diagnostics are redacted.