Watch-only blockchain invoicing

Direct settlement, 0% gateway fee.

Funds never touch our servers. CCRails verifies peer-to-peer transfers directly against public blockchain nodes using watch-only address manifests while your BIP-39 keys stay offline in your own vault.

$0.00 gateway spread 8 assets / 9 networks 0 server private keys

Self-custodial invoice

Settled / 2 conf

140.00USDC

0% fee

USD Coin on Base

Watch-only intake shard #02

BASE L2

Merchant address 0x71C9a4f0...49b2C18

HMAC-SHA256 webhook: 200 OK Paid directly to merchant

Settlement engine

On-chain verification built for real buyer behavior

Buyers withdraw from exchanges that deduct flat fees, pick the wrong EVM chain, or split transfers across two wallets. CCRails resolves each edge case deterministically without holding custody.

Software-only architecture: checkout pages render raw wallet addresses for mobile scanners and never assert payment intermediation.

01 Zero server-side private keys

Watch-only public manifests

Edge nodes store public deposit addresses only. Your 24-word seed stays inside offline local keychain storage with hardened per-project derivation accounts (10', 20', 30', 40'), eliminating hot-wallet sweep gas and server compromise exposure.

BIP-39 offline vault Hardened account isolation BIP-84 SegWit bc1q

02 Atomic D1 session leases

Deterministic shard and memo matching

Concurrent checkouts lock (project_id, chain, asset, address, amount_atomic) across 5 intake shards and 0..19 micro-cent offsets. Exact +$0.00 amounts allocate across all 5 shards first, while TON uses 12-character HMAC tags and Bitcoin assigns dedicated SegWit addresses.

5 shards x 20 offsets Opaque TON HMAC memo 60m rolling rate lock

03 Automated recovery

Exchange fee absorption and wrong-asset rescue

Exchange withdrawals often arrive $1 short. Invoices settle automatically whenever shortfall stays within min($1.50, 7%), and the rescue scanner checks sibling tokens (USDC, USDT, native) across all 5 shared 0x EVM networks at live spot USD.

min($1.50, 7%) tolerance Cross-EVM 0x rescue Multi-tx partial top-ups

04 Single-file SDK

Double-lock webhooks and stealth proxy

Drop proxy_adapter.ts into any Cloudflare Worker with zero external packages. Storefronts verify HMAC-SHA256 signatures within a 300-second replay window, cross-check session state via signed pull API, and optionally proxy /pay/:token on their own domain.

x-ccrails-ts <= 300s Constant-time HMAC First-party /pay/:token

Supported rail matrix

8 core assets across 9 public networks

20 verified chain-asset routes

Accepted assets (stablecoins and native L1/L2)

USDC

5 networks / 1:1

USDT

7 networks / 1:1

ETH

Base / Arb / Mainnet

SOL

Solana native

TON

TON + HMAC tag

BTC

Native SegWit

BNB

BNB Smart Chain

TRX

Tron native

Verified settlement networks

Base

2 conf (~4s)

Arbitrum One

2 conf (~4s)

Solana

32 conf (~12s)

Tron

19 conf (~57s)

TON

1 conf (~6s)

Polygon

16 conf (~32s)

BNB Smart Chain

5 conf (~15s)

Ethereum

3 conf (~36s)

Bitcoin

1 conf (~10m)

Protocol boundary

Custodial crypto gateways take 0.5% - 2.56% per invoice, pool merchant balances in shared hot wallets, and pause payouts behind compliance tickets. CCRails strips custody out of the loop: buyers pay your wallet directly on public chains while an edge worker verifies confirmation depth and signs your fulfillment webhook.

Inspect technical specification

Why CCRails?

Sovereign treasury isolation by default

Every storefront operates inside its own cryptographic boundary with independent HMAC keys, origin allowlists, and non-overlapping deposit shards.

100% direct merchant receipt

No settlement intermediary sits between buyer and merchant. Every transfer lands directly in your project's own wallet branch with $0.00 gateway fee and no payout hold queue.

Per-project blast-radius isolation

Multi-brand operators assign separate hardened derivation paths (10', 20', 30', 40') per storefront. Public block explorers never see shared deposit addresses across unrelated products.

Bounded edge execution

Checkout sessions run on Cloudflare Workers and D1 with headless production routing, no-referrer headers, and scheduled cron reconciliation capped at 40 RPC subrequests per 5-minute tick.

Step 1 / Buyer wallet or CEX

Peer-to-peer on-chain transfer

Raw deposit address QR (Base, Arbitrum, Solana, Tron, TON, BTC)

100% of value settles on public chain

Step 2 / Merchant cold or keychain branch

Isolated watch-only intake shard

Keys remain offline in merchant vault (ccrails-treasury)

Read-only RPC log + confirmation check

Step 3 / CCRails edge verifier

Signed webhook + pull cross-check

HMAC-SHA256 delivery (x-ccrails-sign) to merchant origin

Verification guarantees

Engineered for deterministic checkout completion

60-minute rate lock

Volatile assets (ETH, SOL, TON, BTC, BNB, TRX) hold a locked spot quote for 60 minutes while USDC and USDT price at 1:1 USD parity.

Cumulative partial top-ups

Underpaid invoices switch to partially_paid, display the exact remaining balance on the checkout screen, and sum multiple claimed transactions until full settlement.

Universal QR scanner payloads

Checkout QR codes encode raw 0x, bc1q, Base58, and TRC-20 addresses rather than fragile EIP-681 contract URIs that mobile wallets and CEX scanners reject.

Live sandbox and integration

Ready to test a live invoice?

Walk through asset selection, shard leasing, partial top-up simulation, and instant receipt verification in the interactive checkout sandbox.

Wanna connect? Mail [email protected]

Launch live demo Mail [email protected]