Crypto payments for SaaS: bill in USDC, keep the keys

Deniz Yanbollu · September 8, 2026

SaaS teams asking how to take crypto payments for SaaS usually get a custodial processor: a balance they do not control, a percentage on every invoice, and a freeze risk if the account looks “wrong”. You can skip that path. Shieldz is a non-custodial checkout: the customer pays on-chain, funds settle to the wallet you configured, and your app learns about it from a signed webhook. $0 platform fee, no KYC to start.

This sits next to the crypto payment API quickstart and how to accept crypto payments. Use those for the HTTP details. Use this post for the SaaS-specific loop: plan amount, invoice, hosted checkout, webhook, entitlement.

Why SaaS billing and custodial gateways fight each other

Card rails price a $29/month plan as a percentage plus a fixed fee. On a year of that plan, 2.9% + 30¢ per charge is material. A custodial crypto gateway often adds its own cut and a withdrawal delay. Chargebacks do not exist on a confirmed on-chain payment, which is useful for digital access, but only if the processor cannot freeze the balance after the customer paid.

A non-custodial model removes the middle balance. You store a public receive key (an address, an xpub, or a Zcash viewing key). Shieldz derives a fresh pay target per invoice and watches the chain. It cannot spend. Verify that claim on /verify if you need the cryptographic version.

What the SaaS loop looks like

1. Your billing job decides the amount in USD cents (plan price, seat add-on, or one-off invoice).
2. You POST /api/v1/invoices with amount_usd_cents, a memo, an idempotency_key, and metadata that points at the customer and the period.
3. You send the customer to pay_url (hosted checkout with QR and wallet deep-link).
4. On confirm, Shieldz POSTs invoice.paid to your webhook. You verify X-Shieldz-Signature and grant the period.
5. Settlement lands in the token and chain you configured. If the buyer pays a different supported coin, swap-settle routes through NEAR, Chainflip, or Relay via the LeoKit aggregator. Shieldz takes no affiliate cut on that swap.

Amount bounds on the API today: $1.00 to $100,000.00 per invoice (amount_usd_cents 100 to 10,000,000). Default expiry is 30 minutes (45 minutes when ZEC is in play).

Step-by-step: wire it to your billing stack

1. Create a merchant and a receive target

Sign in at the dashboard. Add the public key or address for the chain you want to settle on. Prefer USDC or USDT if you want invoice amounts to match books. See accept stablecoin payments.

2. Mint an API key

Dashboard → Developers. sk_live_… moves real funds. sk_test_… is for staging. The raw key is shown once.

3. Create the invoice from your backend

curl https://shieldz.cash/api/v1/invoices \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "amount_usd_cents": 2900,
    "memo": "Pro plan, Sep 2026",
    "idempotency_key": "sub_cus_123_2026_09",
    "metadata": { "customer_id": "cus_123", "period": "2026-09" }
  }'

Redirect or email pay_url. Reuse the same idempotency_key if the job retries.

4. Verify the webhook before you extend the plan

Header: X-Shieldz-Signature: t=<unix>,v1=<hex>. HMAC-SHA256 over `${t}.${rawBody}` with your whsec_ secret. Use the raw body, not a re-serialized JSON object. Deliveries are at-least-once. Key fulfilment on invoice.id plus your period metadata so a retry does not double-credit. Full snippet is in the API post.

5. Recurring plans without storing cards

On-chain checkout is pull-less. For monthly SaaS you generate a new invoice each period and send the link (email, in-app banner, or payment link). When the webhook fires, extend the entitlement. If it expires unpaid, keep the account in a grace state the same way you would for a failed card.

Agents and keyless flows are a separate cluster: crypto payments for AI agents and the MCP path. Billing an individual contractor instead of a subscriber base? See crypto payments for freelancers.

What not to promise in your pricing page

• Shieldz does not hold a merchant balance and cannot pay you out in fiat. If you need fiat settlement, that is a different product class. See crypto payment gateways and fiat settlement.
• Gas is paid by the buyer (and by the swap route when they pay a non-settlement asset). Do not market “free on-chain transfers”.
• NEAR and SOL are not live source chains for swap-settle right now. Do not list them as pay-in options.

FAQ

Can I take crypto for monthly SaaS plans? Yes. Create one invoice per period, send pay_url, grant access on a verified invoice.paid webhook. There is no on-chain mandate you can charge later without the customer sending again.

Do I need KYC to start? No. Signup is wallet, Google, or Telegram. Read do crypto payment gateways require KYC and accept crypto payments without KYC.

Where does the money go? To the address or derived child address from the public key you registered. Shieldz never holds keys. Details in non-custodial crypto payment gateway.

What if the customer pays a different coin than I settle in? Swap-settle quotes through NEAR, Chainflip, or Relay (LeoKit). You still receive the settlement asset you configured, with no Shieldz take rate on the swap.

Start

Create a merchant, then either paste invoices from the dashboard or follow the API reference. WordPress stores should use the WooCommerce plugin instead of a custom billing job.