Why every 402pay checkout gets its own address

The trouble with one address

The simplest crypto checkout shows everyone the same address and asks each customer to add a memo or send an exact amount. It works until it doesn't. Wallets drop memos. Exchanges strip them. Two people paying the same price at the same moment look identical on-chain, and someone ends up reconciling a spreadsheet by hand.

A shared address also puts every customer's payment on one public page, where anyone can add up your revenue, see who your biggest customers are and watch how much you take in each day.

Neither problem is exotic. They're the reason so many crypto checkouts ask customers to send an exact amount, copy a reference into a memo field, or email a screenshot afterward. Every one of those is a step where a real customer can get it wrong.

An address per checkout

So we never share one. Whether your customer opens a payment link or your server creates a checkout through the API, the checkout comes back with an address made just for it, in crypto.address:

curl -X POST "https://dash.402pay.co/api/v1/checkouts" \  -H "Idempotency-Key: $(uuidgen)" \  -H "Content-Type: application/json" \  -d '{    "payment_code": "2jrsrcxv7k",    "rail": "crypto",    "asset": "USDC",    "network": "polygon"  }'

{  "data": {    "id": "chk_C5yhPQvPqpYgdDgj",    "status": "open",    "crypto": {      "asset": "USDC",      "network": "polygon",      "amount": "49.00",      "address": "0x9a3c416D4A81669C01f4515bBDEB93C45d3813fe"    },    "expires_at": "2026-09-26T21:37:47.047Z"  }}

Whatever lands at that address belongs to that checkout, whatever the amount and whenever it arrives. A short payment is still attributable. So is one that turns up days late. Nobody has to type a memo, and nobody else's payment shows up next to it.

What your customer sees

None of this machinery shows on the customer's side. They pick a coin and a network, and checkout shows one address and the exact amount to send. The price holds for 15 minutes by default, long enough to open a wallet app or log in to an exchange, and you can set it anywhere from 5 minutes to an hour.

Because nobody else will ever pay that address, there's nothing to get wrong. No memo to copy, no reference number, no “please send exactly this much” in red.

And if they close the tab halfway through, nothing is lost. Opening the payment's link again resumes the same payment rather than starting a new one, so a customer who wanders off to find their wallet comes back to exactly where they left.

Making addresses without the keys

Here's the catch. 402pay is self-custody: your wallet's recovery phrase is made in your browser and never reaches us. Without it, how can our servers create addresses that only your wallet can spend from?

Modern wallets are built in layers. The recovery phrase produces private keys, which can spend. Those produce public keys, which can't spend anything, but can produce new addresses, one after another, that all belong to the same wallet. When you set up your wallet, your browser hands us only the public keys.

We can make your next address. We can never move what's in it.

Solana needed a different trick

On Ethereum, Polygon, Tron and Bitcoin, that layered design is standard, and wallets have used it for years. Solana is different. Its wallets lock every layer, so a public key alone can't make the next address. For a processor that refuses to hold keys, that was a wall.

We went around it rather than through it. For checkout addresses only, your browser sets up a second, separate set of Solana keys using an established scheme that keeps the layers open, the same one Cardano wallets rely on. Your main Solana address stays exactly where any Solana wallet expects it.

Checked before it counts

A wrong address would be the worst kind of bug: money arriving somewhere your wallet can't reach. So three separate checks have to agree before your first customer ever sees an address, and a fourth runs every night after that.

If any address ever failed the nightly audit, new checkouts would stop until we knew why. A paused checkout is an inconvenience. A misdirected payment isn't something we're willing to risk.

Short, late and extra payments

Real payments are messy. Exchanges take their cut out of a withdrawal, wallets round, and some customers come back to pay the next morning. With an address that belongs to one checkout, every one of those still has somewhere to go.

• Short by 0.5% or less, unless you change it, and it counts as paid in full.
• Shorter than that, and it's marked underpaid. Checkout shows your customer what's left, to the same address.
• Too much, and the whole amount lands in your wallet.
• Late, up to 7 days after the quote expires, and it's still matched to its checkout and held for your review.

None of these needs a support ticket or a manual search through transactions. Because the address itself says which checkout a payment belongs to, the payment arrives already sorted, and the only decision left for you is whether to accept an underpaid or late one.

What it means for you

For the business on the other end, all of this adds up to something simple. In practice it means:

• Every payment matches itself. No memos, no exact amounts, no reconciliation by hand.
• Your revenue isn't public. Each customer pays a different address.
• Nobody can freeze your funds, us included. There's no key on our side to do it with.
• You can always leave. A public recovery page finds and moves your Solana funds with just your recovery phrase.

It's a small idea, an address per checkout, but it's what lets 402pay handle crypto payments the way businesses expect payments to work: each one tied to its order, and each one yours.