Crypto

Pay your users on-chain by sending stablecoins directly to a wallet address they provide.

This page is for advanced / cryptocurrency-native companies. If that’s not you, head back to the Quickstart for the standard flows.

Crypto Payouts

Crypto Payouts let you pay a user in cryptocurrency instead of to a bank account, card, or wallet app. Your integration provides the destination wallet address, chain, and token; Coinflow funds the transfer from your Coinflow wallet.

How It Works

  1. You create a destructive API key — a dedicated, highest-risk credential that can only perform crypto payouts
  2. Your integration calls the delegated payout endpoint with speed: "crypto" and the user’s destination address, chain, and token
  3. Coinflow debits your Coinflow wallet for the payout amount plus the delivery fee, screens the destination for compliance, and delivers the tokens on the destination chain
  4. The withdrawal completes with a shareable receipt link you can send to your user as proof of payment

On-chain transfers are final. They settle in seconds and cannot be recalled, reversed, cancelled, or refunded. Coinflow does not validate destination addresses — if the address your integration provides is wrong, malformed for the chain, or controlled by an attacker, the funds are gone. Address, chain, token, and amount are your responsibility.


Prerequisites

Before using Crypto Payouts, ensure:

  • Crypto payouts are enabled on your merchant account — contact the Coinflow integrations team to enable this feature
  • The user (withdrawer) has completed KYC verification
  • Your Coinflow wallet holds enough balance to cover the payout amount plus the delivery fee
  • You have created a destructive API key (see below)

Create a Destructive API Key

Crypto payouts require a dedicated API key with the destructive role. This key is fully isolated:

  • It is the only credential that can initiate crypto payouts — your admin, editor, and viewer keys cannot, and neither can dashboard sessions
1

Open API Keys in the dashboard

Go to Developers → API Keys in the merchant dashboard and click Create Key.

2

Select the Destructive role

Choose Destructive as the key’s role. Read the risk statements shown in the dialog and check both acknowledgment boxes — creation is blocked until you do, and your acknowledgment is recorded in your account’s audit log.

3

Restrict and store the key

Add the IP addresses or CIDR ranges your servers call from (required in production). The key is shown once — store it in a secrets manager. Never put it in frontend code, a repository, a config file, or a support ticket.

If this key leaks, you bear the loss. Anyone holding it can drain your available balance with irreversible transfers. A key exposed in source control, CI logs, error reporting, a browser bundle, or a compromised machine is still a valid key, and Coinflow cannot distinguish its use from your own. If you suspect exposure, disable and revoke the key in the dashboard immediately.


Supported Chains & Tokens

Every chain and token is identified by a stable id: chainId is a CAIP-2 chain id (e.g. eip155:8453) and tokenId is the lowercase token symbol (e.g. usdc). These ids are the values your integration passes as the payout destination’s chain and token — they never vary by delivery route, and the same pair always has the same ids.

Retrieve the chains and tokens enabled for your account dynamically:

GET
/api/merchant/withdraws/payout/crypto/tokens
1curl https://api-sandbox.coinflow.cash/api/merchant/withdraws/payout/crypto/tokens \
2 -H "Authorization: <apiKey>"
Response
1{
2 "chains": [
3 {
4 "chainId": "string",
5 "name": "string",
6 "logoUrl": "string",
7 "tokens": [
8 {
9 "tokenId": "string",
10 "symbol": "string",
11 "name": "string",
12 "logoUrl": "string"
13 }
14 ]
15 }
16 ]
17}

The response shown is an example. The actual chains, tokens, and image URLs differ between sandbox and production and reflect what is enabled on your account. Always use the API response to populate your UI, and pass the returned chainId and tokenId verbatim in your payout requests — chain display names are not accepted.


Quote a Crypto Payout

Preview a crypto payout before sending it: the total your Coinflow wallet would be debited, the fee, the USD value the user receives, and the amount of the destination token that will be delivered. Quoting is read-only — nothing moves — and accepts your admin key as well as your destructive key.

1{
2 "userId": "user-1234",
3 "amount": { "cents": 2500, "currency": "USD" },
4 "account": {
5 "chain": "eip155:8453",
6 "token": "usdc"
7 }
8}
POST
/api/merchant/withdraws/payout/delegated/quote/crypto
1curl -X POST https://api-sandbox.coinflow.cash/api/merchant/withdraws/payout/delegated/quote/crypto \
2 -H "Authorization: <apiKey>" \
3 -H "Content-Type: application/json" \
4 -d '{
5 "userId": "string",
6 "amount": {
7 "cents": 1,
8 "currency": "USD"
9 },
10 "account": {
11 "token": "string",
12 "chain": "string"
13 }
14}'
Response
1{
2 "quote": {
3 "cents": 1,
4 "currency": "USD"
5 },
6 "totalMerchantDebit": {
7 "cents": 1,
8 "currency": "USD"
9 },
10 "userPayout": {
11 "cents": 1,
12 "currency": "USD"
13 },
14 "merchantFees": {
15 "cents": 1,
16 "currency": "USD"
17 },
18 "deliveryAmount": "string"
19}

The response’s deliveryAmount is the amount of the requested destination token the user will receive, as a decimal string in the token’s own units.

Quotes for non-stablecoin tokens (SOL, ETH, …) are estimates at the current market rate and are not guaranteed — the delivered amount is finalized when the payout is processed.


Initiate a Crypto Payout

Call the standard delegated payout endpoint with speed: "crypto" and the on-chain destination as the account, authenticated with your destructive API key. A crypto payout’s request body looks like:

1{
2 "userId": "user-1234",
3 "amount": { "cents": 2500 },
4 "speed": "crypto",
5 "idempotencyKey": "d9a4d8f2-1b2c-4e5f-8a7b-3c6d9e0f1a2b",
6 "account": {
7 "address": "0x1234abcd...",
8 "chain": "eip155:8453",
9 "token": "usdc"
10 }
11}

All values above (userId, address, idempotency key) are examples — replace them with real values from your integration.

POST
/api/merchant/withdraws/payout/delegated
1curl -X POST https://api-sandbox.coinflow.cash/api/merchant/withdraws/payout/delegated \
2 -H "Authorization: <apiKey>" \
3 -H "Content-Type: application/json" \
4 -d '{
5 "speed": "crypto",
6 "userId": "user-1234",
7 "idempotencyKey": "d9a4d8f2-1b2c-4e5f-8a7b-3c6d9e0f1a2b",
8 "account": {
9 "address": "0x1234abcd...",
10 "chain": "eip155:8453",
11 "token": "usdc"
12 },
13 "amount": {
14 "cents": 2500
15 }
16}'
Response
1{
2 "effectiveSpeed": "crypto",
3 "signature": "4Cv4nbe6fkGpdSYcqhPHXkdndeiyTa8mhFoWW5x3vroxRibAUssrbXZ5VW4vxkPedcX3xTRKu7ZpkJXWKdJBCGuq"
4}

Request Fields

FieldDescription
userIdThe ID of the KYC-verified user being paid
amount.centsThe payout amount in USD cents. The user receives exactly this when your account covers withdraw fees; otherwise your configured payout fee comes out of it
speedMust be "crypto"
idempotencyKeyA unique key (V4 UUID recommended). Retries with the same key return the original result instead of paying twice
account.addressThe user’s wallet address on the destination chain. Not validated by Coinflow
account.chainA chainId from the crypto payout tokens endpoint (e.g. eip155:8453)
account.tokenA tokenId from the crypto payout tokens endpoint — the lowercase token symbol, matched case-insensitively

Reusing an idempotencyKey is always safe: a retry returns the original payout’s signature instead of sending funds twice — a key can never produce a second transfer, so always use a fresh key for a new payout.

Fees

Coinflow covers the on-chain delivery cost. Your account’s configured crypto payout fee follows your fee-responsibility setting: when your account covers withdraw fees, the user receives exactly amount and your Coinflow wallet is debited amount plus the fee in a single transfer; otherwise your wallet is debited exactly amount and the fee comes out of the delivered amount. Fees are never billed separately or invoiced later — they appear on the withdrawal record as merchant-paid or user-paid fees accordingly.

Crypto payouts are enabled and priced per token tier (stablecoins/majors ex: BTC, SOL, ETH) on your account — contact the integrations team to enable them or adjust pricing.


Compliance Screening

Every destination address is screened against sanctions and risk intelligence immediately before delivery — no funds leave Coinflow to a destination that hasn’t passed screening.

  • If a flag is raised, the payout pauses in pending while Coinflow’s compliance team reviews it. Cleared payouts resume automatically; confirmed matches remain blocked and Coinflow will contact you.

Tracking & Proof of Payment

Crypto payouts appear on the Withdrawals tab of the merchant dashboard with the destination token and chain shown as the payout method. Opening a withdrawal shows the chain the funds were sent on, the destination wallet, and — once the transfer completes — a proof of payment receipt: a block-explorer link you can copy and send to your user.

Programmatically:

  • You receive the standard withdraw webhooks: Withdraw Pending when the payout is accepted and Withdraw Success when the tokens are delivered.
  • Look up any payout via GET /merchant/withdraws?search=<idempotencyKey>. Completed crypto payouts include a cryptoPayoutInfo object with the destination chain, token, destinationAddress, the delivery transaction signature, and the shareable receipt URL.
  • The withdrawal’s expected delivery date is set to the actual completion time when the transfer lands — crypto payouts typically complete within minutes.

Errors

  • Crypto withdrawals require an API key with the destructive scope — you called speed: "crypto" with an admin or other non-destructive credential. Use your crypto sends key.
  • Destructive API keys can only be used for crypto withdrawals — your crypto sends key was used for a non-crypto payout speed. Use your admin key for those.
  • account must be a crypto destination with address, chain and token for crypto withdrawals — the destination object is missing or incomplete.
  • Unsupported chain: ... / Token ... is not supported on chain ... — pass a chainId and tokenId from the crypto payout tokens endpoint. Chain display names (e.g. "Base") are not accepted.
  • Crypto payouts are not enabled for this merchant — the destination token’s tier isn’t enabled on your account; contact the integrations team.
  • No crypto payout provider is configured for this merchant — crypto payouts aren’t enabled on your account yet; contact the integrations team.
  • 402 Insufficient Funds — your Coinflow wallet can’t cover the payout plus your configured payout fee.
  • 409 Idempotency key conflict — the original request with this key is still in flight; wait for it to finish and retry to receive its result.
  • 503 — the funding transfer hit a temporary issue; retry the request immediately with the same idempotencyKey.