# Q8QPay

> Non-custodial USDT payment gateway. Merchants connect their own USDT wallet
> addresses; Q8QPay never stores private keys and never holds merchant funds.
> Invoices are confirmed only on an exact match of network, address, amount
> (to 4 decimal places), and expiry window — there is no underpayment or
> overpayment handling.

Q8QPay accepts USDT only, on three networks: USDT_TRC20 (Tron), USDT_ERC20
(Ethereum), and USDT_BSC (BNB Smart Chain). Merchants create invoices via a
REST API; customers pay to the merchant's own wallet address; Q8QPay's blockchain
watchers detect the transfer and confirm the invoice only if the network,
address, and amount match the invoice exactly before it expires. Confirmed
payments trigger an HMAC-SHA256-signed webhook (X-Webhook-Signature header) to
the merchant's callback URL, with automatic retries on failure.

## Product
- [Product Overview](https://q8qpay.com/product): Non-custodial architecture, exact-match invoice system, multi-network support, webhook system, admin dashboard.
- [How It Works](https://q8qpay.com/how-it-works): The payment flow — create invoice, customer pays, blockchain detection, exact-match verification, webhook delivery.
- [Pricing](https://q8qpay.com/pricing): Pay-as-you-go transaction fee, no monthly minimums, no setup fees.

## Developers
- [API Documentation](https://q8qpay.com/developers): REST API reference for creating invoices, wallets, webhooks, and sandbox testing.
- [FAQ](https://q8qpay.com/faq): Answers on custody model, supported networks, exact-match behavior, and webhook verification.

## Key facts
- Supported asset: USDT only, on the TRC20, ERC20, and BSC networks.
- Custody model: non-custodial — no private keys stored, no merchant funds held, no transactions sent on the merchant's behalf.
- Matching rule: network + payout address + amount (exact to 4 decimal places) + within the invoice expiry window. No underpaid or overpaid matching.
- Invoice expiry: configurable from 5 minutes to 2 hours (default 30 minutes).
- Webhook security: HMAC-SHA256 signature in the X-Webhook-Signature header, verified against the merchant's webhook secret.
- Required confirmations before a payment is considered final: 20 (TRC20), 12 (ERC20), 15 (BSC).