Everything, in one place.

Getting started

Base URL is https://api.norpo.io. Everything is JSON over HTTPS. There is no SDK to install and no sandbox to switch off — the requests below are the live ones.

The fastest path to a first payment is three lines of curl: create an order with your wallet, send the customer to the returned link, and watch for the callback. Nothing to register first.

Keys & authentication

Keyless requests need no header at all. When you do have an account, send the key as a bearer token and drop wallet from the body — the payout address saved in your settings is used instead.

# keyless — nothing to send
curl -X POST https://api.norpo.io/v1/orders -d '{…}'

# with an account
curl -X POST https://api.norpo.io/v1/orders \
  -H "Authorization: Bearer nrp_live_sk_…" \
  -d '{…}'

Accounts are issued by hand over Telegram — @norpoio. Keys are shown once at creation and stored only as a hash, so a lost key is replaced, never recovered.

Card payments

The customer pays with a card, Apple Pay, Google Pay or a bank transfer on a hosted checkout; you settle in USDC on Polygon. Norpo never holds the money.

curl -X POST https://api.norpo.io/v1/onramp \
  -H "Content-Type: application/json" \
  -d '{
      "amount":      250.00,
      "currency":    "USD",
      "wallet":      "0x<your 40-hex EVM address>",
      "callbackUrl": "https://shop.tld/hook",
      "redirectUrl": "https://shop.tld/thanks",
      "reference":   "order-1042"
     }'

# → 201
{
  "id":          "cmr1y…",
  "status":      "pending",
  "settleAsset": "USDC",
  "url":         "https://pay.norpo.io/pay.php?…"
}

# redirectUrl is optional — with it, the customer is
# returned to your page after paying.

Crypto payments

Accept a named coin on a named chain. Each order gets a deposit address of its own, and settlement forwards to the address you supplied.

curl -X POST https://api.norpo.io/v1/orders \
  -H "Content-Type: application/json" \
  -d '{
      "ticker":      "polygon/usdc",
      "amount":      25,
      "wallet":      "0x<your 40-hex EVM address>",
      "callbackUrl": "https://shop.tld/hook",
      "reference":   "order-1042"
     }'

# → 201
{
  "id":     "cmsey…",
  "status": "pending",
  "ticker": "polygon/usdc",
  "amount": 25,
  "payTo":  "0x2FE2…9580"
}

# tickers: btc · eth · xmr · sol/sol · trx · ltc
#          polygon/usdc · erc20/usdt · trc20/usdt …

Exchange

Same-chain or cross-chain conversion across 60+ coins. Anonymous and non-custodial: the customer sends one coin to a one-time address and receives another at a wallet they name.

curl https://api.norpo.io/v1/swap/tickers

{ "tickers": ["btc", "eth", "polygon/usdt", "xmr", … ] }

Virtual cards

Prepaid Visa, Mastercard, PayPal balance or Binance gift cards, from $5 to $1,000, funded with crypto. Sold without an ID check, though activation may still ask for a name, email, phone and address — and card issuers refuse activation for residents of some countries, which voids the refund.

curl https://api.norpo.io/v1/vcc/providers

{ "cards": {
  "visa":    { "status": "available",   "amount": { "min": 5, "max": 1000 } },
  "paypal":  { "status": "available",   "amount": { "min": 5, "max": 1000 } },
  "binance": { "status": "available",   "amount": { "min": 5, "max": 500  } },
  "mastercard": { "status": "out of stock" }
} }

Callbacks

Pass callbackUrl when you create an order and Norpo calls it once the payment settles. It is a nudge, not a receipt: re-check the order with GET before you release anything, and make the handler idempotent — it can fire more than once.

GET https://shop.tld/hook
  ?status=paid
  &order_id=cmsey…
  &reference=order-1042
  &amount=25&ticker=polygon/usdc
  &value_coin=25.000000
  &txid=0x4b…9af

# match by reference, re-check status, then fulfil

Accounts also get signed webhooks with retries, configured in the dashboard — use those when you need delivery guarantees rather than a single best-effort call.

Errors

Failures come back as JSON with a message. Where the upstream provider refuses, its own sentence is passed through unchanged so you can act on it instead of guessing.

Plugins & modules

Both are free, both work without an API key, and both settle to the wallet you paste into their settings.

Before you ship

The things that actually trip people up, in the order they hit them.

The field is wallet

Not address, not recipient. A wrong name returns 400 naming the offending field — read that before anything else.

One address, one order

Every order opens its own deposit address. Never reuse one: a second payment to a settled address is not credited automatically.

Match the network exactly

A polygon/usdc order takes USDC on Polygon. The same coin on another chain is a different asset and the funds are lost. The API checks the shape of your receiving address, not which chain you meant.

Cards expire in ten minutes

Card issuers drop an unpaid order after roughly ten minutes, and a deposit landing later can be lost. Show the countdown; do not let a customer pay a stale order.

Confirm before you fulfil

Treat the callback as a nudge, not a receipt. Re-check with GET before releasing goods, and keep the handler idempotent — it can fire more than once.

Amounts are decimal strings

Send 250.00, not cents. Currency is the three-letter code; the customer pays in it and you settle in USDC.

Something not covered here? Ask on @norpoio — a real person answers.