API Reference

DESTROY.WTF is a crypto payment gateway. You create an order over a single API call; we generate a fresh deposit address, watch the chain for the customer's payment, and once it confirms we forward the funds to the payout address you configure — minus a flat fee. One REST API, twelve assets, JSON everywhere.

Base URL

https://destroy.wtf

Authentication

Generate an API key (a UUID) from your dashboard under API Keys. Send it in the JSON request body as api_key on every authenticated call.

Order tokens (customer side)

Creating an order also returns an update_token (embedded in the payment_gateway_url as #token=…). It grants read access to that one order without the API key, and is what the hosted payment page uses. Send it in the x-update-token header (or an update_token body field) on status / update.

Payment flow

The whole integration is: create an order, show the customer the address, and watch the status (by webhook or by polling).

Create order

curl -X POST https://destroy.wtf/api/order/create \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "b3f1…UUID",
    "amount_usd": 149.99,
    "crypto_type": "BTC"
  }'

{
  "success": true,
  "order_id": "ord_10f83a9c…",
  "crypto_type": "BTC",
  "amount_usd": 149.99,
  "crypto_amount": "0.00234375",
  "crypto_address": "bc1qxy2…0wlh",
  "payment_gateway_url": "https://…/pay/ord_…#token=…",
  "expire_time": "2026-01-01T12:00:00Z"
}

Order status

Update order

Cancel order

Supported assets

{
  "success": true,
  "supported": { "BTC": 64012.0, "ETH": 3401.2, "USDTTRC20": 1.0 },
  "changes": { "BTC": { "24h": { "pct": 1.42 } } }
}

Limits

Order statuses

Fees & settlement

DESTROY.WTF deducts a flat 3.0% from the amount received and forwards the remainder to your configured payout address; the fee goes to the operator wallet. Your key can be set to a custom rate. Settlement is automatic on COMPLETED — there is no payout schedule and no balance to withdraw.

Webhooks

Register HTTPS endpoints in your dashboard under Webhooks and choose the events to receive. Each delivery is a JSON envelope, signed with a per-endpoint secret. Failed deliveries retry on a backoff, and an endpoint that fails repeatedly auto-disables until you re-enable it.

Events

order.created, order.status_changed, order.updated, plus payout-review signals (order.payout_review, order.payout_review_cleared, order.payout_indeterminate, order.payout_stuck).

{
  "id": "<uuid>",
  "type": "order.status_changed",
  "created": "2026-01-01T12:00:00Z",
  "data": {
    "order_id": "ord_10f83a9c…",
    "status": "COMPLETED",
    "old_status": "CONFIRMING",
    "amount_usd": 149.99,
    "paid_usd": 149.99,
    "crypto_type": "BTC"
  }
}

X-Gateway-Event: order.status_changed
X-Gateway-Event-Id: <uuid>
X-Gateway-Timestamp: 1735732800
X-Gateway-Signature: sha256=<hex>

Verifying the signature

Compute HMAC-SHA256 over "{timestamp}.{raw_body}", using the endpoint secret hex-decoded to bytes as the key, and compare to the hex in X-Gateway-Signature. Reject anything whose timestamp is older than 300 seconds.

import hmac, hashlib

def verify(secret_hex, timestamp, raw_body, signature):
    mac = hmac.new(bytes.fromhex(secret_hex),
                   f"{timestamp}.{raw_body}".encode(), hashlib.sha256)
    return hmac.compare_digest("sha256=" + mac.hexdigest(), signature)

Errors & rate limits

Errors return { "success": false, "error": "<message>" }. Most failures still use HTTP 200 with success: false — always branch on success, not the status code. Rate-limited requests return 429.

Exceeding the rate triggers a temporary 30-second block and HTTP 429. The client IP is read from CF-Connecting-IP when present.

Examples

Create an order, then poll until it settles.

import requests, time

BASE = "https://destroy.wtf"
KEY  = "b3f1…UUID"

# 1. create
r = requests.post(f"{BASE}/api/order/create", json={
    "api_key": KEY, "amount_usd": 149.99, "crypto_type": "BTC",
}).json()
order_id = r["order_id"]
print("Pay", r["crypto_amount"], "to", r["crypto_address"])

# 2. poll (or register a webhook instead)
while True:
    s = requests.post(f"{BASE}/api/order/status",
                      json={"api_key": KEY, "order_id": order_id}).json()
    if s["status"] in ("COMPLETED", "CANCELED"): break
    time.sleep(10)