Overview of the four channels
You can pay with (1) credit/debit card (worldwide, instant), (2) credit/debit card + PayPal + Apple Pay + Google Pay via an alternative gateway with included tax handling, (3) cryptocurrency (BTC, ETH, USDT and 100+ coins), or (4) manual bank transfer / PayPal where we record your payment in the CMS after you confirm with our support team. All four use the same module entitlement engine.
Cards — worldwide
Card checkout is the default for card payments. Pick a module, click Buy, you land on a secure checkout where you enter your card. After payment the provider sends a signed webhook (HMAC-SHA256, replay-protected), the entitlement is granted, and you are redirected to a success page. Receipts are emailed automatically. 3-D Secure / SCA is handled automatically for European cards.
Card with tax — merchant of record
An alternative gateway is available, useful when the default is not available in your country or you want a merchant of record (it handles VAT/sales tax for you in 50+ jurisdictions). Same flow: click Buy, complete checkout, signed webhook (HMAC-SHA256, colon-separated payload), entitlement activates, success page.
Crypto — cryptocurrency
Crypto checkout lets you pay with 100+ cryptocurrencies. After clicking Buy with Crypto you see the BTC / ETH / USDT etc. address and amount, send the payment from your wallet, and the IPN callback (HMAC-SHA512 over sorted JSON) confirms it once the blockchain has the required confirmations. Refunds are issued in the same crypto you paid with; network fees are deducted.
Manual payment — bank transfer or PayPal
If you prefer to pay via direct bank transfer or PayPal (outside the gateways), contact support@xtreamgo.io with the module and license key you want to purchase. We send wire / PayPal details, you confirm payment, and our team manually activates the module from the CMS module store (the same module_store grant endpoint the card webhooks use). Activation usually within 1 business day of payment confirmation.
Security and idempotency
All webhooks are HMAC-signed and timing-safe verified. Replay attacks are blocked by a 5-minute timestamp tolerance. Idempotency keys ensure that even if a webhook retries because of a network blip, your module is granted exactly once — no double-charging, no duplicate activations. If something goes wrong, the CMS retry cron sweeps unprocessed webhook events every 5 minutes for eventual consistency.