About this plugin
Adds a “Pay with USDC” payment method. At checkout the buyer is redirected to a hosted payment page. Funds go straight to the merchant’s own wallet.
The order is marked paid only after the payment is confirmed on chain and the plugin has checked the result with the API.
- Works with the classic checkout and the Cart/Checkout blocks.
- Compatible with High-Performance Order Storage (HPOS).
- Offered for stores in USD, for order totals from 1.00 to 10,000.00 USD.
- Signed webhooks (HMAC-SHA256, 5-minute replay window, duplicate protection) plus a 10-minute backup status check, and a warning when the server clock is off by more than 2 minutes.
- With Test mode off, “API base URL (advanced)” is ignored and cleared. Live requests go only to the production API. Test mode does nothing until that field is an https URL for a non-production API.
The domains this plugin contacts are listed under External services.
External services
FinLinks is an external service operated by Finlinks Global Solutions LLC (Wyoming, United States). An approved FinLinks merchant account is required. Merchant portal access is currently invitation-only; downloading or activating this plugin does not activate payment services.
com/integrations/woocommerce
html
html
html
com/pandafish620/finlinks-woocommerce
api.finlinks.io
The store server contacts the production API when an administrator connects or reconnects the store, tests its connection, registers or verifies its webhook, or sends a test webhook. It also contacts the API when a buyer submits a FinLinks payment, when payment status is checked (including the 10-minute backup check and pending order return checks), and when an open payment session is cancelled.
Authenticated payment and connection-management calls send the API key as a bearer token and the plugin version in the user-agent. Webhook registration also sends the webhook URL, WooCommerce version and plugin version. Connect start and exchange requests instead send the store and return URLs, live/test mode and key-rotation selection where applicable, and temporary connection authorization data (state, authorization code and PKCE challenge/verifier).
The API returns credentials to the store server; API keys and webhook signing secrets are not placed in browser URLs.
Creating a payment session sends the store order ID, a short order label, order amount and currency, return URL, cancel URL and webhook callback URL, and a session expiration interval where configured. Return and cancel URLs may contain order access tokens. Status queries and cancellation requests identify the session or order.
These data support payment creation, store authorization, reconciliation and order status updates. The API sends signed payment notifications to the store at /wp-json/finlinks/v1/webhook.
The plugin does not send separate buyer name, email, phone or postal address fields. Order labels and URLs should not contain unnecessary personal information. Servers also receive technical request information such as the requesting IP address and user-agent.
portal.finlinks.io and pay.finlinks.io
When an administrator clicks Connect, their browser opens the FinLinks portal to sign in and approve the store, carrying a temporary connection state rather than an API key. After a payment session is created, the buyer’s browser opens the hosted payment page with the session ID in its /inv/ URL. Live hosted payment URLs are restricted to these two hosts.
The plugin does not POST the order directly to these browser destinations. Browser navigation shares ordinary request information, including IP address and browser user-agent; subsequent information entered on those services is governed by the FinLinks Privacy Policy.
io business email are used for the service operated by Finlinks Global Solutions LLC. com.
Administrator-configured test API
Test mode requires an explicit HTTPS non-production API URL configured by the administrator. The corresponding connection and payment requests described above go to that configured service instead. Use only a trusted test service and test credentials/data; review that provider’s terms and privacy policy.
io.