Download the PHP package slowbeardigger/xmr-pay-laravel without Composer

xmr-pay for Laravel

Accept Monero in a Laravel app. The money goes straight to your wallet. There is no company in the middle, no account to open, no fee paid to anyone, and nobody can freeze, see, or hold your funds but you.

This is a thin adapter over the xmr-pay engine: a config file, a service, and a facade. The engine does the work in pure PHP, holding only your view key, against a Monero node you choose. No monero-wallet-rpc, no daemon on your box, no backend service.

Install

Then set your wallet in .env. The view key and any node password are sensitive. Stagenet coins are free test XMR:

For authenticated nodes, use structured JSON instead of putting credentials in the URL. JSON takes precedence over the legacy XMRPAY_NODES list:

Supported authentication modes are none, basic, and digest. Authenticated plain HTTP is blocked unless that node sets allow_insecure_http to true; use the opt-in only for a trusted private network. Keep the JSON in .env, never in version control.

Laravel resolves these values into bootstrap/cache/config.php after php artisan config:cache. Protect that file with the same server permissions as .env and clear/rebuild the cache when node credentials change.

Use it

Give each order a unique receiving subaddress, show the buyer a QR, and check the chain when you poll or run a job. The facade resolves the configured service.

checkOrder() sums every confirmed payment to the order's subaddress, so a partial payment or a top-up settles once the total adds up. The scan is bounded; for a long-open order, call it again from the returned scanned_to + 1 on the next poll.

If you would rather have the buyer paste a transaction id ("I've paid"), verify a single one:

The truths (please read before taking real money)

Monero is irreversible and the sender is hidden, so there are no automatic refunds. If you need to refund someone you send them XMR back by hand. You are trusting the node you point it at. A public node is fine for tips; for real revenue run your own, or list two nodes so a lagging one can only delay a payment, never confirm it early. Few confirmations is fast but reversible. Raise XMRPAY_MIN_CONFIRMATIONS for higher-value orders. That is your risk dial. The browser is never trusted. Release goods only after checkOrder()/verifyPayment() confirmed a real payment on-chain.

How it works

Nothing always-on is required. checkOrder() reads public chain data from the node and does the Monero math in PHP with your view key: it derives the order subaddress, detects the output, verifies the RingCT amount commitment, and counts confirmations. The same engine powers xmr-pay for WooCommerce; the verification is cross-checked against the reference Monero library on real stagenet payments.

Status

New. The engine underneath is the same one the WooCommerce plugin runs in production, and this adapter is verified end to end against real stagenet payments. It has not yet seen wide Laravel production use. Test on stagenet first.