iCareForex · Cashier

NOWPayments crypto gateway — how money moves

Deposits run automatically through NOWPayments end to end. Withdrawals stay on manual, admin-approved payouts by design. Here is each path, step by step.

Automated — no manual step Manual — needs an admin
Deposit · Automated

Client tops up their wallet

Create an invoice, the client pays on-chain, a webhook credits the wallet.

1
Client · Cabinet

Starts a deposit

Cashier → Deposit → Crypto → picks USDT TRC20 or BEP20, enters an amount, taps Get Deposit Address.

2
Cabinet → Backend

Requests an invoice

POST /api/payments/nowpayments/create-deposit

{ amount, network }

3
Backend → NOWPayments

Creates the payment

Backend calls NOWPayments POST /payment (with x-api-key). It returns a unique pay-address, the exact USDT amount, and a payment_id.

4
Client

Sends the crypto

The cabinet shows the address + QR + exact amount. The client sends USDT from their own wallet or exchange.

5
NOWPayments → Backend

Confirms via webhook

POST /api/payments/nowpayments/ipn

Signature verified with HMAC-SHA512 (IPN secret) before anything is trusted.

6
Backend

Auto-credits the wallet

On a confirmed / finished payment the main wallet is credited. Idempotent — deduped by nowpayments:<payment_id>, so a repeated webhook can't double-credit. Balance updates on its own.

Withdrawal · Manual

Client requests a payout

A pending request is created, an admin reviews it, and the payout is sent by hand.

1
Client · Cabinet

Requests a withdrawal

Cashier → Withdrawal → E-Wallet → enters an amount and picks a saved wallet address.

2
Cabinet → Backend

Creates a pending request

POST /api/wallet/withdraw

Status → PENDING. This path does not call NOWPayments.

3
Admin

Reviews & approves

An admin checks the request in the admin panel and approves it.

4
Admin

Sends the payout by hand

The crypto is sent manually. A NOWPayments payout API exists in the backend but is switched off.

Why manual? Automated payouts are off by design — NOWPAYMENTS_PAYOUTS_ENABLED = false. Turning them on needs the payout-account login, 2FA, and a whitelisted IP, because payouts move real money out.

Where this stands today

The gateway is built and verified — but one deployment step gates live customer use.

Live backend

Deposit endpoints are deployed and verified on api.icareforex.com — API key valid, IPN registered. Payouts gated.

Not yet customer-facing

The deposit UI that calls this lives in the rebuilt cabinet (the preview site). The old live cabinet still uses the previous HD-wallet flow — so no live customer routes through NOWPayments until the new UI ships to live.

In dev/testing

On staging, create-deposit returns a mock address so the UI is testable without real money. The auto-credit webhook needs a public, writable backend to run.