StableCart for WooCommerce

Description

StableCart lets a WooCommerce shop take USDC (a dollar stablecoin) on the Base network. The buyer pays your wallet directly, in one blockchain transaction. StableCart never holds the money and cannot freeze, delay or reverse it.

Setup takes one minute. Paste your wallet address into the gateway settings and save. The plugin registers your shop with the StableCart service by itself: there is no account to open, no email to confirm, no API key to copy and no identity check. If you can receive USDC in a wallet, you can take payments.

What the buyer sees. At checkout they pick “USDC on Base” and land on a pay page with the exact amount and a QR code. They scan it with any wallet app on their phone, or pay from a browser wallet such as MetaMask or Coinbase Wallet. The page updates itself while the network confirms the payment, then sends them to your order-received page. The pay page speaks English and Serbian.

What you see. The order moves to Processing (or Completed for virtual goods) the moment the payment has enough confirmations, with a note linking the transaction on Basescan. If a buyer sends too little, the order goes On hold with a note saying how much arrived, and nothing is refunded automatically.

Prices in any currency. Your shop can be priced in EUR, GBP, RSD or anything else. The plugin converts the order total to US dollars at a daily market rate (or a rate you pin yourself) and the buyer pays that in USDC.

Plans. The free plan covers 20 paid orders per calendar month. Pro is $12 for 30 days, unlimited, paid in USDC from the gateway settings with one click; it switches on by itself. There is no subscription to cancel. The gateway settings show how many orders you have used.

How it stays safe

• Every payment gets its own exact amount (for example 45.000173 USDC). That is how StableCart knows which order was paid without giving each order a new wallet.
• Payment notifications are signed (HMAC-SHA256). The plugin checks the signature against the raw request before touching an order.
• A payment only completes an order if it was quoted for that order’s amount.
• Blockchain reorganisations are handled: a payment that disappears from the chain does not complete an order.

External services

This plugin relies on two external services. Both are listed below with what
they send, when, and links to their terms and privacy policy.

1. StableCart (https://www.stablecart.org) — the payment service this plugin is
a client of, operated by Fantom Studio. It watches the Base blockchain for the
USDC payments made to your own wallet and tells your shop when an order is paid.
Without it the plugin cannot work.

What is sent, and when:

• When you save the settings with a wallet address: your wallet address, your
  shop URL and a webhook secret generated on your site, to register the shop.
  The same data is sent again if you later change the wallet address.
• When a buyer opens the pay page: the order total converted to US dollars and
  an order reference (the order id plus a fragment of the order key). The
  buyer’s browser also loads the checkout script from the service. No customer
  name, email or address is ever sent.
• When the settings page is opened: your merchant id, to read your plan and how
  many orders you have used.
• When you click “Upgrade to Pro”: your merchant id, in the link that opens the
  payment page on the service.
• The service calls back to your site at ?wc-api=stablecart to report a
  payment. That request is signed and verified before it is acted on.

Terms of service: https://www.stablecart.org/terms/ — Privacy policy:
https://www.stablecart.org/privacy/

2. ExchangeRate-API (https://open.er-api.com) — used only when your store
currency is not USD, to convert the order total to US dollars, because payments
are quoted in dollars. The plugin requests the public daily rate table once
every six hours and caches it; the request contains no data about your store,
your orders or your customers. Set a rate manually in the gateway settings if
you prefer the plugin never to contact it.

Terms: https://www.exchangerate-api.com/terms — Privacy policy:
https://www.exchangerate-api.com/privacy

The pay page also links each confirmed payment to basescan.org, a public
block explorer, so you and your buyer can verify the transaction. Nothing is
sent there by the plugin; it is a plain link.

Technical details