[XB] Payment Provider: NOWPayments 2.0.2 Release Candidate 1

This update significantly improves the NOWPayments checkout experience with live cryptocurrency estimates, minimum payment validation, and clearer payment information. It also reworks recurring payments and introduces major security and reliability improvements across payment creation, IPN handling, subscriptions, refunds, and payment status tracking.

This is a release candidate version. Please take a full backup before installing it on a production site.

Click to expand...

Important​

• NOWPayments payment profiles now require both an API Key and IPN Secret. Profiles without a valid IPN secret will no longer accept payment notifications.
• XenForo 2.3 or newer is now required.

New Features​

• Added live cryptocurrency payment estimates that automatically refresh when the selected currency changes.
• Added minimum payment amount checks and warnings based on the selected cryptocurrency, settlement currency, fees, and rate settings.
• Added an optional minimum purchase amount per payment profile for both standard and recurring payments.
• Added clearer checkout and payment information, including:
  • Item price
  • Currency tickers
  • Empty currency states
  • Partial payment details
  • Payment IDs for failed payments

Improvements​

• Reworked recurring payments to better follow XenForo's payment provider architecture.
• Subscription state is now stored with the purchase request, replaced subscriptions are resolved through the payment provider log, and plans are managed through NOWPayments.
• Cancelling a recurring subscription now marks the associated user upgrade as cancelled.
• Payment creation, subscription replacement, quote refresh, and related payment actions now use protected POST requests.
• Payment currencies are now loaded only during checkout and cached independently for each payment profile and sandbox/live mode.

Security​

• Hardened IPN verification so notifications are accepted only for the correct payment profile and purchase.
• Added timing-safe IPN signature comparison.
• Restricted payment status, estimates, expiry, confirmation, and subscription management to the purchaser.
• Added rate limits for payment creation, recurring payment creation, status checks, and estimate requests.
• Added persistent duplicate protection for simultaneous or repeated payment, subscription, and refund notifications.
• Removed XenForo security tokens from requests forwarded to NOWPayments.

Bug Fixes​

• Fixed Unicode content and small cryptocurrency amounts causing valid payment notifications to fail signature verification.
• Fixed failed and expired payment notifications repeatedly generating payment provider log errors.
• Fixed purchases being started with currencies unsupported by the configured NOWPayments account.
• Fixed payment estimates failing after cache expiration or using outdated amounts.
• Fixed rapid cryptocurrency changes displaying outdated estimates or QR codes.
• Fixed QR codes using invalid wallet URI schemes.
• Fixed payment pages occasionally missing currency names, logos, or QR codes after cached currency data expired.
• Fixed expired quotes retaining outdated amounts or restarting the previous payment window.
• Fixed the payment expiration timer not using the expiration time reported by NOWPayments.
• Fixed payment status polling continuing after a final payment state or after the payment window closed

Fix: Ensure that the subscription plan title is limited to 50 characters when updating an existing plan

Fix: delete existing subscription on new recurring payment initialization

Fix: Limit subscription plan title to 50 characters