TECHNICAL ARCHITECTURE
How Zateway Works Under the Hood
Zateway is a non-custodial crypto payment gateway built on smart contracts. Every payment is routed on-chain — no funds ever touch Zateway's servers. Here's the complete technical picture.
The Complete Payment Flow
Merchant Creates a Payment Session
The merchant's backend calls POST /v1/payments with the amount, currency (USDT or USDC), and a webhook URL. Zateway returns a payment session object containing a unique deposit address on each supported chain.
POST /v1/payments
{
"amount": "99.00",
"currency": "USDT",
"chain": "polygon",
"webhook_url": "https://yourstore.com/webhooks/zateway",
"metadata": { "order_id": "ord_123" }
}Customer Sees the Checkout
The customer is shown a QR code and wallet address to send exactly 99 USDT on Polygon (or their preferred chain). A real-time countdown timer gives 15 minutes for payment — after which the session expires.
// Response: payment session
{
"id": "pay_9Kx2mN3",
"status": "pending",
"address": "0x7f3e...a4c2",
"chain": "polygon",
"amount": "99.00",
"expires_at": "2025-06-12T10:30:00Z"
}Customer Sends USDT to Zateway Smart Contract
The customer's wallet sends USDT to Zateway's smart contract address on Polygon. The contract is the receiving address — not Zateway's own wallet. The contract logic is immutable and publicly verifiable on Polygonscan.
// On-chain contract call (Polygon) ZatewayRouter.receivePayment( recipient: "0xMerchantWallet", // Merchant's address amount: 99_000000, // 99 USDT (6 decimals) paymentId: "pay_9Kx2mN3" // Links to session )
Smart Contract Routes Funds (1% Fee)
The smart contract immediately splits the payment: 98 USDT (99%) goes directly to the merchant's wallet. 1 USDT (1%) goes to Zateway's fee collector address. This all happens atomically in a single transaction — not two separate transfers.
// Contract execution (atomic, one tx) → Merchant wallet receives: 98.01 USDT → Zateway fee address receives: 0.99 USDT → Transaction hash: 0x8f4a...b2c1 → Block: #47,231,445 → Confirmations: 1 (instant finality)
Multi-Chain Monitor Detects Payment
Zateway's blockchain monitor (watching all 6 chains in parallel) detects the incoming transaction to the smart contract. It validates: correct payment ID, correct amount, correct token contract address, and minimum confirmations.
// Internal monitor event
{
"event": "payment.detected",
"payment_id": "pay_9Kx2mN3",
"tx_hash": "0x8f4a...b2c1",
"amount_received": "99.00",
"confirmations": 1,
"chain": "polygon"
}Webhook Fires to Merchant Server
Once confirmed, Zateway's Webhook Outbox sends an HMAC-SHA256 signed POST request to the merchant's webhook URL. The merchant verifies the signature and fulfills the order. If delivery fails, Zateway retries with exponential backoff for up to 72 hours.
// Webhook payload (HMAC-signed)
POST https://yourstore.com/webhooks/zateway
X-Zateway-Signature: sha256=7d2e...f3a1
{
"event": "payment.completed",
"payment_id": "pay_9Kx2mN3",
"amount": "99.00",
"currency": "USDT",
"chain": "polygon",
"tx_hash": "0x8f4a...b2c1",
"metadata": { "order_id": "ord_123" }
}Core System Components
Six specialized components work together to process every payment securely, reliably, and without custody.
Smart Contract Router
The core of Zateway. An on-chain smart contract that receives each payment, deducts the 1% fee, and routes the remaining 99% directly to the merchant's wallet. The fee percentage is immutable — not even Zateway can change it after deployment. Auditable on-chain by anyone.
Multi-Chain Monitor
A distributed monitoring layer that maintains full-node connections to all 6 supported blockchains simultaneously. When a payment is detected in a Zateway smart contract, the monitor captures the transaction hash, amount, sender, and chain within milliseconds of block confirmation.
Webhook Outbox (HMAC-signed)
Once a payment is confirmed, Zateway's Webhook Outbox queues a signed notification to the merchant's callback URL. Webhooks are signed with HMAC-SHA256 using your API secret — verifiable on the merchant's server to prevent spoofing. Failed deliveries are retried with exponential backoff up to 72 hours.
Settlement Engine
Tracks every payment's lifecycle from 'pending' → 'confirming' → 'settled'. Because Zateway is non-custodial, settlement means on-chain finality — funds are already in the merchant's wallet. The Settlement Engine updates payment status and triggers downstream webhooks.
REST API Layer
A stateless REST API for creating payment sessions, querying payment status, generating payment links, and managing webhooks. Every API request is authenticated with bearer tokens. Rate limits: 100 req/min on Free, 1,000 req/min on Pro.
Key Management (Non-Custodial)
Zateway NEVER stores, handles, or has access to merchant private keys. Merchants connect their own wallet address (Metamask, Phantom, hardware wallet). The smart contract is programmed to route directly to this address — no intermediate custody step.
6 Supported Blockchains
Zateway monitors all 6 chains simultaneously. Customers pay on whichever chain is cheapest for them — merchants receive on the same chain.
Polygon
MATIC
SPEED
~2s
GAS FEE
< $0.01
Solana
SOL
SPEED
~400ms
GAS FEE
< $0.001
Base
ETH (L2)
SPEED
~2s
GAS FEE
< $0.01
BSC
BNB
SPEED
~3s
GAS FEE
< $0.05
Arbitrum
ETH (L2)
SPEED
~1s
GAS FEE
< $0.05
Optimism
ETH (L2)
SPEED
~2s
GAS FEE
< $0.05
Security Properties
Non-Custodial by Design
Zateway's servers never hold private keys or control merchant funds. The smart contract routes payments automatically — no human intervention.
Immutable Fee Rate
The 1% fee is hardcoded in the deployed smart contract. No admin key can change it after deployment. Merchants can verify this on-chain.
HMAC-Signed Webhooks
Every webhook is signed with HMAC-SHA256 using your API secret. Verify the X-Zateway-Signature header before processing any order fulfillment.
Open Smart Contracts
Zateway's router contracts are publicly deployed and verifiable on Polygonscan, Solscan, and block explorers for all supported chains.
Ready to integrate?
Full API docs, webhook guides, and code examples in the developer portal.