Crypto payments for your Minecraft server store

CoinsFlow lets your server's own store take crypto. When a player checks out, the store makes an invoice and sends them to the payment page. When a signed webhook says it is paid, the store runs the command that gives the rank or the cosmetic. You pay 0.5% per payment.

How it works

1. A player picks a package in your store and gives their Minecraft name. The store makes an invoice with POST /v1/invoices: the price in dollars, and the player and the package in metadata.
2. The player is sent to the invoice's paymentUrl. With no coin named, they pick one there: Litecoin, Bitcoin, Ether, BNB, USDT or USDC.
3. When it is paid, invoice.paid reaches your store's webhook: on Litecoin at the first confirmation, about 2.5 minutes, and with USDT on BNB Smart Chain in about 15 seconds.
4. The store runs the package's command, over RCON or through your own plugin, once per invoice.
5. The money is in your balance. Withdraw it to your own wallet, by hand or automatically.

A $10 rank, in numbers

The invoice

POST /v1/invoices
{
  "priceAmount": "10.00",
  "orderId": "store-5531",
  "description": "VIP rank",
  "metadata": { "player": "Steve", "package": "vip" }
}

Check the player's name when they give it, before you make the invoice. metadata is never shown to the player and comes back in every webhook; the order id and the description are shown on the payment page. Every field is in the API docs.

The webhook runs the command

import express from "express";
import { Rcon } from "rcon-client";

// Your packages and their commands. Only the player's name comes from the order.
const COMMANDS = {
  vip: (player) => `lp user ${player} parent add vip`,
  mvp: (player) => `lp user ${player} parent add mvp`,
};
const app = express();

app.post("/webhooks/coinsflow", express.raw({ type: "application/json" }), async (req, res) => {
  if (!Buffer.isBuffer(req.body) || !verified(req.get("CoinsFlow-Signature"), req.body)) return res.sendStatus(400);
  const event = JSON.parse(req.body.toString("utf8"));
  if (event.type !== "invoice.paid") return res.sendStatus(200);
  if (event.test && !process.env.TESTING) return res.sendStatus(200); // test events only while you test
  const { id, metadata } = event.data;
  const command = COMMANDS[metadata.package];
  // A Minecraft name is 3 to 16 letters, digits and _: nothing else reaches the console.
  if (!command || !/^\w{3,16}$/.test(metadata.player ?? "")) return res.sendStatus(200);
  try {
    if (!(await delivered(id))) { // your database: once per invoice
      const rcon = await Rcon.connect({ host: "127.0.0.1", port: 25575, password: process.env.RCON_PASSWORD });
      try {
        await rcon.send(command(metadata.player));
      } finally {
        await rcon.end();
      }
      await markDelivered(id);
    }
    res.sendStatus(200);
  } catch {
    res.sendStatus(500); // CoinsFlow sends it again later
  }
});

app.listen(3000);

verified() is the signature check from the docs, over the raw body. The commands here are LuckPerms'; use your own. Keep RCON off the public internet: run the webhook on the same machine as the server, or in its private network. The endpoint itself must be an https:// address on the public internet.

What your store may sell

CoinsFlow is not an official Minecraft service, and is not approved by or associated with Mojang or Microsoft.