№ 003 · Developers REST · GraphQL · Webhooks · 8 SDKs

Built by
engineers, for
engineers who ship.

Idempotency keys on every endpoint. Webhooks with replay and 30-day history. A sandbox that mirrors production, network-for-network. Documentation that doesn't lie.

Quickstart Full reference

Quickstart

First payment.
Six lines.

Create a charge, send the customer a URL, listen for the webhook. The rest is your business logic.

01 · CREATE A CHARGE

# POST https://api.coinmoove.io/v1/charges
curl https://api.coinmoove.io/v1/charges \
  -H "Authorization: Bearer sk_live_•••" \
  -H "Idempotency-Key: ord_4f8a2c1" \
  -d amount=149.00 \
  -d currency=EUR \
  -d accept[]=BTC,ETH,USDC \
  -d settle_to=EUR

02 · RESPONSE

{
  "id": "ch_01H9YJ7K",
  "status": "awaiting_payment",
  "amount": 14900,
  "currency": "EUR",
  "hosted_url": "https://pay.coinmoove.io/ch_01H9YJ7K",
  "expires_at": "2026-05-14T19:42:01Z"
}

03 · HANDLE THE WEBHOOK

// PHP — POST /webhooks/coinmoove
$payload = file_get_contents('php://input');
$sig     = $_SERVER['HTTP_COINMOOVE_SIGNATURE'];

if (!CoinMoove::verify($payload, $sig, $secret)) {
    http_response_code(400);
    exit;
}

$event = json_decode($payload, true);

if ($event['type'] === 'charge.confirmed') {
    fulfilOrder($event['data']['reference']);
}

http_response_code(200);

SIGNATURE: HMAC-SHA256 OVER RAW BODY · ROTATING SECRETS · 5-MINUTE REPLAY WINDOW

SDKs

Eight tongues.
One API.

First-party, MIT-licensed, with type definitions where they exist. Generated against the same OpenAPI spec the docs use — the SDK never drifts from the truth.

PHP

composer require coinmoove/sdk

Node

npm i @coinmoove/sdk

Python

pip install coinmoove

Ruby

gem install coinmoove

go get coinmoove/go

Java

io.coinmoove:sdk

.NET

dotnet add CoinMoove

Rust

cargo add coinmoove

DX · 01

Idempotency, always.

Every mutating endpoint accepts an idempotency key. Retry safely. Avoid double-charges on flaky networks.

DX · 02

Webhooks with replay.

Inspect, replay, and re-deliver the last 30 days of events from the dashboard. Signed payloads, rotating secrets.

DX · 03

Sandbox = production.

Same API surface, real testnets, fake assets. The only difference is the network ID. Switch with one env var.

DX · 04

Versioned, never broken.

API version pinned at account level. Breaking changes ship to a new version — older versions are supported for at least 24 months. You move on your schedule.

DX · 05

Logs you can grep.

Every request, response, and webhook attempt is searchable for 90 days. Export as JSON or stream to your SIEM.

Built by engineers, for engineers who ship.

First payment.Six lines.

Eight tongues.One API.