ChangelogCopy Anchor Link

All notable changes to PayzCore, SDKs, and integrations.

---

2026-10-15 — Security & reliability releaseCopy Anchor Link

October 2026

PlatformCopy Anchor Link

• Dependencies upgraded: Next.js 16.4, React 19.3, Auth.js (next-auth) beta.32, Fumadocs 16.17, Tailwind CSS 4.3, ESLint 10
• Transfer detection: TRC20 counts only real Transfer events of the token contract to the watched address (token approvals are ignored); TronGrid results are paginated; BSC and EVM scan windows start from the block at the right timestamp instead of a block-time estimate; Etherscan rate limits are handled; BSC transfers count as confirmed only once finalized; malformed provider rows are skipped instead of failing the whole check
• Account security: sessions end immediately after suspension, password or email change, deletion request or 2FA reset (a password change signs out every device); suspended accounts are rejected on every dashboard action; 2FA challenges are single-use and TOTP codes cannot be replayed; disabling 2FA now needs a current 2FA code; login email is case-insensitive; login rate limits and Turnstile checks run in a stricter order
• Webhook URLs: stricter private/reserved IP blocking (IPv4 and IPv6) when a webhook URL is saved and again right before every delivery; stored delivery responses are capped at 256 characters
• API: CORS headers on /v1/*; unknown hosts get 404; repeated unknown API keys from one IP get 429; POST /v1/projects (master key) accepts owner_email so the new project's API key works right away
• Shopify app endpoints: HMAC and single-use nonce checks on install, encrypted Shopify access tokens, order amount and USD currency checked before a payment is created
• Operations: database migrations run one transaction per file with a lock (safe with several instances), graceful shutdown (health returns 503 while draining), cached health check that also reports Redis, queue workers and the outbound proxy (degraded), pinned Docker base image
• Dashboard: project owners can retry their own failed webhooks; xPub keys must be account-level (m/44'/coin'/0') and are checked when a wallet is saved; address balances are no longer overwritten when a balance read fails
• Docs site: docs.payzcore.com/robots.txt and /sitemap.xml are served
• Payments and webhooks:
  • One webhook payload for every code path; external_order_id is always present (null if none) and amounts are decimal strings with at least 2 decimals ("50.00", "50.07", not "50.070000"), the same in every API response
  • Late payments: per_payment and pool + txid payments are re-checked for 24 h after expiry; full funds move them to paid/overpaid with "late_payment": true
  • No more early expiry: a payment past its deadline is checked on-chain once more; confirming payments get 30 extra minutes
  • payment.partial counts confirmed funds only and is sent again for a larger amount
  • payment.completed and payment.overpaid no longer count toward (or get dropped by) the daily webhook limit
  • One transaction can no longer be credited to two payments; pool micro-amount offsets are not reused for 6 hours
  • txid mode: hashes are normalised (0x optional, case-insensitive) and must be a transfer to the payment's own address inside its window; several transfers add up
  • per_user / dedicated: a different order for a customer with a payment in progress returns 409 with existing_payment_id
  • Webhooks are never sent unsigned; delivery re-checks the URL (SSRF) each attempt

API contractCopy Anchor Link

• GET /v1/config → setup_url now points to Getting Started (the old link returned 404)
• Documentation now matches the API exactly: validation errors return { "error": "Invalid request body" } without a details array; X-RateLimit-* headers are sent only on 429 responses; X-RateLimit-Reset is an absolute Unix timestamp
• New guides: Hosted Payment Page and Data Retention

SDKsCopy Anchor Link

• payzcore (Python) v1.0.3 — fixes KeyError: 'existing' on every new payment; projects.list() returns api_key_prefix; list() returns pagination and accepts created_after / updated_after; get() returns paid_at; webhook parser accepts network / address = null; POST is retried only when external_order_id is set
• payzcore/payzcore-php v1.0.3 — same fixes (existing warning/exception on new payments, apiKeyPrefix, pagination, updatedAfter, paidAt, parseWebhook() with null network/address); curl_close() removed for PHP 8.5
• @payzcore/node v1.1.8 — existing is now always a boolean; apiKeyPrefix, updatedAt, paidAt, pagination, createdAfter / updatedAfter; webhook payload types allow null network/address/token; no automatic retry of POST without externalOrderId
• n8n-nodes-payzcore v1.1.13 — rejected webhooks now return a real HTTP 401 (previously 200)

PluginsCopy Anchor Link

• WooCommerce v1.0.3 — Cart/Checkout Blocks support; paying again after an expired payment now creates a new payment; atomic webhook lock (a concurrent delivery gets 503 so it is retried); tested with WordPress 7.1 and WooCommerce 11.2
• WHMCS v1.0.2 — paying an invoice again after its payment expired or was cancelled now creates a new payment (WHMCS-{invoice}-r…) instead of returning the expired one; includes the 1.0.1 QR fix
• OpenCart v1.0.1 — same "pay again after expiry" fix (oc-{order}-r…); the webhook callback looks up payments by payment_id first
• Zapier v1.0.1 (not published) — "Payment Status Changed" uses updated_after; invalid metadata JSON now fails instead of being ignored
• Make (not published) — "Get Payment" output fields match GET /v1/payments/:id

---

2026-05-16 — BSC scanner fixCopy Anchor Link

• BEP20 (BSC) transfer detection: restored the token-transfer category filter and split block ranges into 1,000-block windows, so large ranges no longer miss transfers

---

2026-03-21 — Admin login fixCopy Anchor Link

• Admin login with 2FA: fixed the error lookup in the 2FA step

---

2026-03-07 to 2026-03-11 — QR codes and plugin updatesCopy Anchor Link

• QR codes returned by the API (qr_code) are now standard black-on-white for better scanner compatibility. Plugins show them on a white background.
• WooCommerce v1.0.2 (2026-03-10) — security hardening and WordPress.org compliance (SSRF check on the confirm endpoint, webhook idempotency lock, no SVG QR codes, generic customer error messages, HTTPS-only API URL). Live on WordPress.org.
• WHMCS v1.0.1 and XenForo v1.0.1 — QR code visible on light backgrounds
• Dashboard: 2FA setup on the admin settings page, billing page keeps a pending payment and lets you cancel it, dropdown and credential-field fixes
• Security audit: 17 fixes across the platform

---

2026-03-02 to 2026-03-05 — Security auditsCopy Anchor Link

• Six rounds of security and production audits (CSP nonce-based script policy, rate limiting, webhook SSRF checks, JWT session invalidation, precision fixes and more)
• EVM networks (ERC20, Polygon, Arbitrum): pagination for token-transfer queries
• @payzcore/node v1.1.7 and n8n-nodes-payzcore v1.1.12 — User-Agent version and timestamp enforcement
• WHMCS module live on the WHMCS Marketplace

---

v1.0.1 — Security HardeningCopy Anchor Link

March 2026

Breaking ChangesCopy Anchor Link

• Webhook signature format changed: HMAC now covers timestamp + "." + body instead of body only. All webhook handlers must be updated to include the X-PayzCore-Timestamp header in signature verification. See Webhook Verification.

SecurityCopy Anchor Link

• TOTP 2FA: per-user salt replaces static salt for secret encryption
• TOTP: removed legacy fallback decryption path
• Webhook: timestamp binding prevents replay attacks (Stripe-style pattern)

SDKs UpdatedCopy Anchor Link

• @payzcore/node v1.1.6
• payzcore (Python) v1.0.2
• payzcore/payzcore-php v1.0.2
• n8n-nodes-payzcore v1.1.11

All SDKs now require the timestamp parameter for webhook verification.

---

v1.0.0 — Initial ReleaseCopy Anchor Link

February 2026

PayzCore's first public release. Non-custodial stablecoin transaction monitoring API with SDKs, CMS plugins, and automation integrations.

Core PlatformCopy Anchor Link

• Dashboard with real-time payment monitoring, analytics, and global search
• REST API with OpenAPI specification at docs.payzcore.com
• 5 networks: TRC20, BEP20, ERC20, Polygon, Arbitrum
• 2 tokens: USDT and USDC (USDC not available on TRC20)
• HD wallet derivation (watch-only xPub, BIP-44)
• 4 address modes: per_payment, per_user, dedicated, pool
• Pool matching: micro_amount (auto-offset) and txid (customer submits tx hash)
• Webhook notifications with HMAC-SHA256 signatures and retry logic (5 attempts)
• Plan-based access control with Free and Pro tiers
• Email verification, TOTP 2FA, Cloudflare Turnstile
• Telegram bot notifications with per-event configuration
• Analytics dashboard with volume, status, network, and token charts
• Per-project dust filter (minAmount setting)
• Protection Key webhook security
• Rate limiting with daily plan counters
• Payment Links — shareable URLs for no-code payment collection (fixed or open amount, buyer info fields, store branding)

SDKsCopy Anchor Link

• Node.js — @payzcore/node on npm. TypeScript, zero dependencies, ESM + CJS
• Python — payzcore on PyPI. Python 3.9+, httpx-based, Flask and Django examples
• PHP — payzcore/payzcore-php on Packagist. PHP 8.1+, PSR-4, Laravel examples

CMS PluginsCopy Anchor Link

• WooCommerce — WordPress 5.8+, WC 7.0+, HPOS compatible
• WHMCS — v7.x and v8.x, invoice auto-credit, multi-network selector
• OpenCart — 3.x, OCMOD installer, network and token selection
• XenForo — 2.2+, payment provider integration, phrase-based i18n
• Shopify — Express.js app, OAuth, multi-network checkout

AutomationCopy Anchor Link

• n8n — Community node with triggers and actions
• Zapier — Triggers, actions, and searches
• Make — Modules, webhook trigger, and connection

API EndpointsCopy Anchor Link

Webhook EventsCopy Anchor Link