Documentation

Integrate CM5 Wallet Payments

The CM5 Wallet Payments API lets you accept crypto payments directly on your website. Your users pay through their secure CM5 Wallet — no intermediary.

Create your partner account at wallet.cm5-markets.com/partners/dashboard/ to get your API keys.

1

Create a partner account

Sign in to the partner dashboard, create your service and retrieve your api_key and secret_key.

2

Generate the payment URL

Send a POST to the API with your keys and transaction details. You receive a redirect URL.

3

Redirect the user

Redirect your customer to the URL received. They sign in to their CM5 Wallet and confirm the payment.

4

Receive the webhook confirmation

Once the payment is confirmed, your webhook endpoint automatically receives the transaction details.

Authentication

All requests include api_key and secret_key in the JSON body.

Never expose your secret_key client-side. Your keys are available in the partner dashboard.

Create a payment

Send a POST request to get the payment URL to redirect your customer to.

POST https://api.cm5-markets.com/partners/wallet/v2/auth

Parameters (JSON)

Parameter	Type	Required	Description
api_key	string	Required	Your public API key
secret_key	string	Required	Your secret key (server-side only)
currency	string	Required	Crypto symbol: `USDT`, `BNB`, `TRX`…
network	string	Required	Network: `TRC20`, `BEP20`, `ERC20`…
amount	string	Required	Amount as string: `"0.00001"`, `"10.50"`
order_number	string	Optional	Internal reference returned in webhooks

Send amount as a string to preserve precision for small values like "0.00001".

Request example

JSON
{
  "api_key": "your_api_key",
  "secret_key": "your_secret_key",
  "currency": "USDT",
  "network": "TRC20",
  "amount": "10.50",
  "order_number": "ORDER-2024-001"
}

Success response

JSON
{
  "success": true,
  "redirect_url": "https://wallet.cm5-markets.com/web/auth?k=eyJzaWQiOi..."
}

Immediately redirect your user to redirect_url.

Possible errors

HTTP	Message	Cause
400	api_key and secret_key are required	Missing parameters
400	currency, network and amount are required	Incomplete transaction
400	amount must be a positive number	Invalid amount
401	Invalid API credentials	Incorrect credentials
403	Service key is disabled	Service disabled
422	Unsupported currency or network	Unsupported crypto or network

Webhooks

Set your webhook URL in the partner dashboard. We send a JSON POST to this URL on every payment event.

Webhooks are sent in real time. Your endpoint must respond with HTTP 2xx. The X-CM5-Event header contains the event name.

On successful payment, the user is automatically redirected to your configured succes_url with a ?txid= parameter appended. On cancellation or expiry, the redirect goes to your erreur_url.

Verifying authenticity (HMAC signature)

Every webhook is signed with an HMAC-SHA256 signature, computed from the raw JSON body and your api_key. It is sent in the X-CM5-Signature header as sha256=<hash>. Recompute this signature on your side and compare it before processing the webhook, to confirm it genuinely comes from CM5 Wallet and hasn't been tampered with.

Never use == or === to compare signatures — use hash_equals() (constant-time comparison) to avoid timing attacks.

PHP
<?php
$payload = file_get_contents('php://input');
$receivedSignature = $_SERVER['HTTP_X_CM5_SIGNATURE'] ?? '';

$expectedSignature = 'sha256=' . hash_hmac('sha256', $payload, $yourApiKey);

if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    exit('Signature invalide');
}

$data = json_decode($payload, true);
// $data['event'], $data['status'], $data['amount']... peuvent être traités en confiance

payment.completed

Triggered when a payment is confirmed.

JSON
{
  "event": "payment.completed",
  "id": "482039174628591",
  "order_number": "ORDER-2024-001",
  "status": "paid",
  "currency": "USDT",
  "network": "TRC20",
  "currency_icon": "https://...",
  "network_icon": "https://...",
  "to_address": "TXxxxxxxxxxxxxxx",
  "from_address": "TYxxxxxxxxxxxxxx",
  "amount": "10.50",
  "txid": "0xabc123...",
  "paid_at": "2024-01-15 14:32:00",
  "created_at": "2024-01-15 14:20:00"
}

payment.expired

Triggered when a payment request expires without confirmation (10 minutes).

JSON
{
  "event": "payment.expired",
  "id": "482039174628591",
  "order_number": "ORDER-2024-001",
  "status": "expired",
  "currency": "USDT",
  "network": "TRC20",
  "amount": "10.50",
  "txid": null,
  "expired_at": "2024-01-15 14:30:00",
  "created_at": "2024-01-15 14:20:00"
}

payment.expired (status: cancelled)

payment.expired — annulé par le client

Same payment.expired event, but with status: "cancelled" — triggered when the user manually cancels the request from their CM5 Wallet.

JSON
{
  "event": "payment.expired",
  "id": "482039174628591",
  "order_number": "ORDER-2024-001",
  "status": "cancelled",
  "currency": "USDT",
  "network": "TRC20",
  "amount": "10.50",
  "txid": null,
  "expired_at": "2024-01-15 14:28:00",
  "created_at": "2024-01-15 14:20:00"
}

Get transactions

POST https://api.cm5-markets.com/partners/wallet/transaction/v2/get

Mode 1 — By ID

JSON
{
  "api_key": "your_api_key",
  "service_id": "your_service_id",
  "action": "by_id",
  "id": 4521
}

Mode 2 — By date

JSON
{
  "api_key": "your_api_key",
  "service_id": "your_service_id",
  "action": "by_date",
  "date_from": "2024-01-01",
  "date_to": "2024-01-31"
}

Mode 3 — Last N rows

JSON
{
  "api_key": "your_api_key",
  "service_id": "your_service_id",
  "action": "last",
  "limit": 20
}

Response

JSON
{
  "success": true,
  "transactions": [
    {
      "id": "482039174628591",
      "order_number": "ORDER-2024-001",
      "currency": "USDT",
      "network": "TRC20",
      "amount_crypto": "10.50",
      "amount_usd": "10.50",
      "to_address": "TXxxxxxxxxxxxxxx",
      "from_address": "TYxxxxxxxxxxxxxx",
      "txid": "0xabc123...",
      "status": "completed",
      "currency_icon": "https://...",
      "network_icon": "https://...",
      "created_at": "2024-01-15 14:20:00"
    }
  ]
}

Supported cryptos

Browse the full list of supported cryptocurrencies and networks with their logos on the dedicated page.

View all available cryptos

Use the exact coin_symbol and network values shown on that page — casing matters (TRC20, BEP20…).

Error codes

HTTP	Meaning
200	Success
400	Missing or invalid parameters
401	Incorrect API credentials
403	Service disabled or access denied
404	Resource not found
422	Unsupported crypto or network
500	Internal server error