Open Source · Self-hosted · Non-custodial · MIT License

Self-hosted, non-custodial crypto payment gateway
Straight to your own address

Non-custodial throughout, zero platform fees when self-hosted, across major EVM chains and Tron.

Payments flow through a smart contract straight to your wallet — even if the database is dumped, there's nothing to steal.

Get Started Free View on GitHub

First $500/mo in volume, 0 fees

Xcash Checkout

Live

Amount due

29.99USDT≈ $29.99

Choose an on-chain asset

USDT· Arbitrum

USDT· Base

USDT· BNB

Payment address

0x7Ab…C4f9

Smart contract

Awaiting payment

14:52

Funds go straight to the merchant's address

MistTrack

Risk score · Low

EVM + Tron

Platform fees (self-hosted)

100%

Non-custodial

No KYC

No ID verification

MIT

Open source

Built forE-commerce invoicesUSDT depositsCross-border settlementSaaS subscriptionsWallets & exchanges

Funds only ever flow to your own address

Xcash is a non-custodial gateway: it relies on no private key or seed phrase to store funds. Every payment runs through a smart contract straight into your merchant wallet, with the destination hardcoded so funds can only ever reach you. Xcash only matches invoices, transitions states, and sends notifications — it never touches or custodies the money. Because no funds are ever held behind a private key, even a full database breach or server compromise has nothing to steal.

Buyer

Scans / sends payment

pays

Collection contract

destination hardcoded

can only flow to

Your address

keys only in your hands

Xcash control plane

Only matches invoices, states & notifications — never touches funds

Even if the database is dumped or the server is breached

No funds are held behind any key in the system — an attacker sees at most invoice data, can't touch the hardcoded fund flow, and there's nothing to steal

No key-based custody

Xcash never holds funds behind a private key or seed phrase — payments land directly in your merchant wallet. With no asset-custody key in the system, there's nothing to steal.

Straight to your wallet

Payments run through a smart contract that hardcodes the destination to your merchant wallet — funds can only ever go to you, and attackers can't rewrite it.

Zero attack surface

The collection contract is minimal, with a single rule: funds can only flow to your address. Nothing to exploit.

No key-based custody Straight to your wallet Zero attack surface MIT, auditable

Invoice Collection vs Deposit Collection

Xcash offers two ways to receive funds, covering every inbound payment flow. Understand the difference before you integrate, then choose the one that fits your business.

Invoice collection

Invoice-style · fixed & timed

Each transaction creates a fixed-amount, time-limited invoice that completes once the buyer pays. Invoice collection supports direct-to-wallet and smart contract mode: collect straight to the project wallet, or assign each invoice a dedicated contract address and sweep automatically.

Fixed-amount, time-limited invoices
Direct-to-wallet and smart contract
Dedicated contract addresses for high concurrency
Ideal for e-commerce & subscriptions

Deposit collection

Exchange-style · dedicated address

Assign each user a dedicated deposit address, shared across chains and monitored in real time. Users can transfer anytime and are credited once confirmed — no order needed, just like an exchange.

Dedicated address per user
Shared across chains, real-time
Transfer anytime, credit on confirm
Ideal for wallets & trading platforms

Everything a payment gateway needs
out of the box

Self-Hosted: Zero Fees

When self-hosted, there is no per-transaction cut; sweep delay and value gates batch transfers, so you only keep a small gas reserve.

Multi-Chain & Token

Major EVM chains with any ERC-20 token, plus USDT and native TRX on Tron.

Smart Contract

Generate a dedicated contract address per invoice, then sweep after confirmation — addresses never collide, and sweep cost stays close to a normal transfer.

Multi-Merchant & Project

Isolate many merchants and projects on a single instance, each with its own auth, signing, and address.

On-Chain Risk Control

MistTrack scores the source address of every payment; API and webhooks carry risk_level and risk_score.

Webhook Callbacks

Real-time delivery of invoice and deposit events, with automatic retries and nonce-based idempotency.

Yipay Compatible

Supports the standard Yipay (易支付) V1 protocol for a smooth migration without rewriting integrations.

Docker Deployment

One-command production deploy with Docker Compose, with automated environment and secret initialization.

How does Xcash compare?

Put Xcash next to the usual ways to accept crypto and the differences are hard to miss.

	Xcash self-hosted	Hosted processors e.g. NOWPayments, CoinPayments	BTCPay Server self-hosted
Custody of funds	Non-custodial, straight to your wallet	Held until payout	Non-custodial
Platform fee	0	typically 0.4%–1% per tx	0
KYC / account approval	None	usually required	None
Stablecoins on EVM + Tron	Any ERC-20, plus Tron USDT	varies by provider	Bitcoin-first, plugins
Exchange-style deposit addresses	Built-in	rare	—
EasyPay V1 protocol	Compatible	—	—

Comparison based on each project's public materials; for selection reference only.

Major EVM chains and Tron

EVM chains support any ERC-20 token — add USDT, USDC, or other on-chain assets as you need. Tron currently allows USDT and native TRX. Enable a new chain by filling in its RPC in the dashboard.

EVM Chains

Any ERC-20 token

Ethereum

BNB Chain

Arbitrum

Base

Polygon

Optimism

+ More EVM

Tron

USDT and native TRX

USDT

TRX

Add a token contract address and enable its chain in the dashboard to accept new assets

Get Xcash up and running in minutes

Deploy

Clone the repo, run init_env.sh to generate secrets, then docker compose up -d to launch the full production stack.

$ git clone https://github.com/xca-sh/xcash.git

$ cd xcash && ./scripts/init_env.sh

$ docker compose up -d

Configure

Log in, fill in chain RPCs, top up the system wallet with a little gas, then create a project and set its collection address (immutable once written to the contract).

# Admin panel

$ Blockchain → Chains → set RPC

$ System → System wallet → top up gas

$ Project → Set collection address (written to contract, immutable)

Integrate

Use the REST API to create invoices and fetch deposit addresses, and receive invoice and deposit events in real time via webhooks.

$ POST /v1/invoice

$ {

$ "out_no": "order-20240101-001",

$ "title": "Premium Plan",

$ "currency": "USD",

$ "amount": "29.99"

$ }

Simple REST API.
Integrate in minutes.

Xcash provides clean RESTful endpoints with HMAC-SHA256 signatures. Create invoices and generate dedicated deposit addresses with a few calls; webhooks deliver payment events in real time, carrying MistTrack risk scores.

PythoncURLNode.jsPHPGo

1import requests
2import hmac, hashlib, json, time, uuid
3
4API_BASE = "https://pay.xca.sh"
5APPID = "XC-A3BK7NMG"
6HMAC_KEY = "your_32_char_hmac_key_here"
7
8def create_invoice():
9    body = json.dumps({
10        "out_no": "order-20240101-001",
11        "title": "Premium Plan",
12        "currency": "USD",
13        "amount": "29.99"
14    }, separators=(',', ':'), ensure_ascii=False)
15
16    timestamp = str(int(time.time()))
17    nonce = str(uuid.uuid4())
18    message = nonce + timestamp + body
19    signature = hmac.new(
20        HMAC_KEY.encode(), message.encode(), hashlib.sha256
21    ).hexdigest()
22
23    resp = requests.post(
24        f"{API_BASE}/v1/invoice",
25        data=body,
26        headers={
27            "XC-Appid": APPID,
28            "XC-Timestamp": timestamp,
29            "XC-Nonce": nonce,
30            "XC-Signature": signature,
31            "Content-Type": "application/json"
32        }
33    )
34    return resp.json()
35
36invoice = create_invoice()
37print(f"Payment URL: {invoice['pay_url']}")

Plug into your existing stack

The official Xcash for WooCommerce plugin is ready today — and thanks to EasyPay V1 compatibility, a whole ecosystem of popular systems works out of the box.

WordPress · WooCommerce

Xcash for WooCommerce

Available v1.0.7

Official plugin — add USDT, USDC and other crypto checkout to your WooCommerce store in a few steps.

WordPressWooCommerce

Download plugin

EasyPay ecosystem

EasyPay V1-compatible systems

Plug-and-play

Any system that speaks the standard EasyPay (易支付) V1 protocol connects to Xcash directly — no integration rewrite needed.

XboardV2boardNew APIDujiaokaAcg-Faka WHMCS in progress

Read the integration docs

Prefer not to self-host? Choose the official hosted version

The open-source edition can be self-hosted. If you prefer not to handle deployment or maintenance, choose the official hosted version maintained by Xcash.

Progressive fees

Monthly volume is charged progressively by bracket. Only the volume inside each bracket uses that bracket's rate.

First $500 in volume every month — 0 fees

To support small businesses and independent developers, Xcash waives all platform fees on each merchant's first $500 of volume every month. Progressive rates only apply once that free allowance is used up.

Loading current fee brackets…

Choose the plan that fits

All hosted plans use the same progressive fee brackets; rates do not vary by plan.

Frequently asked questions

What is Xcash?

Xcash is an open-source, self-hosted, non-custodial crypto payment gateway. Merchants deploy it themselves and keep full control of their private keys and collection address. Invoice and deposit payments flow through smart contracts straight to your collection address — Xcash never touches the funds. Zero platform fees, across major EVM chains and Tron.

How is Xcash different from BTCPay Server?

Xcash covers major EVM chains and Tron, supports any ERC-20 token, and can use smart contract mode to generate a dedicated contract address for each invoice, whereas BTCPay Server is primarily Bitcoin-focused. Xcash also offers deposit collection, multi-merchant/multi-project isolation, and MistTrack on-chain risk control.

How does Xcash keep funds safe?

Every payment goes through a smart contract whose fund destination is hard-wired to your collection address. Even if the server running Xcash is breached, its database is dumped, or keys leak, funds stay safe as long as the collection address is not altered. Xcash is only the control plane — it matches invoices, advances states and sends notifications, and never handles funds.

What do I need to deploy Xcash?

A Linux server (minimum 1 vCPU / 2 GB RAM), Docker and Docker Compose, and RPC node endpoints for the chains you need; enabling Tron collection requires a TronGrid API key. Docker deployment takes a few minutes.

Which cryptocurrencies does Xcash support?

Any ERC-20 token on EVM-compatible chains (Ethereum, BNB Chain, Polygon, Arbitrum, Base, Optimism, etc.) such as USDT and USDC; on Tron it supports USDT and native TRX.

Does Xcash cost anything?

The open-source edition is completely free (MIT license) with zero platform fees — you only pay on-chain gas. If you would rather not self-host, an official cloud-hosted edition is available by subscription; see pricing.

Start accepting crypto with Xcash

Self-host it for free with zero platform fees — or skip the ops and go live in minutes on the official cloud.

Get Started Free View on GitHub

Self-hosted, non-custodial crypto payment gateway
Straight to your own address