2328 Documentation

All production API requests use the following base URL:

All requests must be made overHTTPS. Requests without HTTPS are blocked.

- Accept crypto payments— create payment sessions and redirect customers to a hosted checkout or Telegram MiniApp
- Withdraw funds— programmatically send payouts from your merchant balance to any blockchain address
- Check balances— see merchant account balances per currency, USD equivalents, and AML-locked amounts
- Use static wallets— generate permanent deposit addresses tied to a user or order
- Fetch exchange rates— get real-time rates for fiat and crypto pairs
- Receive webhooks— get notified instantly when a payment status changes

The API allows up to10 requests per second per project. Requests above the limit get an HTTP429 Too Many Requestsresponse — back off and retry.

Hosted checkout and H2H are two presentations of the same Payment API. H2H does not create a weaker or unsigned payment: the backend still creates the invoice, 2328.io still owns the address and status, and signed webhooks remain authoritative for settlement.

These rules apply to every production integration:

- Backend only— keep API keys out of browsers, mobile applications, logs, analytics, and support screenshots.
- Decimal strings— send and store money as strings. Never round cryptocurrency or exchange rates with binary floating-point arithmetic.
- Immutable idempotency keys— generateorder_idbefore the first request and persist the complete request with it. A retry with the sameorder_idcan return the original object rather than applying changed fields.
- Webhook-first settlement— redirects, client polling, transaction hashes supplied by users, and HTTP timeouts are not proof of payment.
- Verify, deduplicate, then mutate— verify the HMAC, claim an idempotency record atomically, update the order/balance once, and return HTTP 200 quickly.
- Reconciliation— periodically query payment, static-wallet, and payout status so a lost webhook cannot leave permanent disagreement.
- Dynamic availability— validate currency/network pairs with/v1/directions; a supported asset can still have one deposit or withdrawal direction temporarily disabled.
- Explicit status policy— decide how your product handles partial payment, overpayment, expiry, AML lock, conversion fallback, and ambiguous upstream timeouts before going live.

For payments, store at minimumuuid,order_id, the original request body,amount,currency,payer_currency,payer_amount,network,address,expires_at, latestpayment_status,txid,payment_amount,merchant_amount, the optionalconvertblock, and the raw verified webhook payload.

For static wallets, keep the walletuuid, address, currency, network, customer/account reference, status, and callback URL separately from deposit records. Each deposit needs its own transactionuuid,txid, status, received amount, merchant amount, and conversion result.

Secure agent purchasing with human-approved virtual cards.

Live Dodo Payments API for AI agents — payments, subscriptions, customers, products, refunds, license keys, and usage-based billing via browser OAuth (no API key needed) plus a companion documentation search server.

AI intelligence oracle + cross-border settlement rail. 10-layer Stability Oracle (climate, macro, FX, ESG) with x402 pay-per-call API. USDC/EURC settlement on Base at 1.385% all-in.

An MCP server that lets an agent autonomously pay any x402 (HTTP 402) API across 29 chains — budget-capped, self-custody, no facilitator or fee.

Script Master Labs Federal, Medical & Finance MCP (x402)

MCP server enabling AI agents to query institutional financial data APIs using x402 payment protocol for autonomous machine-to-machine commerce.

Remote MCP for paid API discovery, API invocation, USDC agent payments, and receipts.

One x402/developer-credit control layer for paid AI/data tool calls, crypto conversion quotes, public MCP discovery, progress streaming, and receipt-backed agent spend governance.

MCP/x402 spend layer for AI agents to quote, pay for, invoke, stream, and receipt paid AI/API calls with crypto or developer credits.

A read-only MCP server by CData for querying live Authorize.Net data.