Crypto Payment APIs Compared: Fees, Chains and Custody 2026

If you are comparing crypto payment APIs by their headline percentage, you are comparing the one number that will have the least effect on your integration. The variables that actually decide your build are custody model, whether a usable testnet exists, whether a payout API exists at all, and whether the provider publishes its webhook retry policy. We checked the public documentation and pricing pages of six providers on 21 September 2026 and filled every cell from a primary source. Several came back empty — that emptiness is itself a selection signal, and we left it visible instead of guessing.

This is an API-layer comparison for the engineer or technical founder who has to defend the choice in a design review. For the merchant-side view of the same market, the crypto payment gateway options for SaaS breakdown covers commercial fit rather than integration surface.

Custody model is an onboarding-time decision, not a security-grade decision

Most comparison posts frame custody as a safety question. In practice it is a calendar question. A custodial provider holds your incoming funds in an account it controls, which makes it a regulated money transmitter in most jurisdictions and makes you its onboarding subject: incorporation documents, beneficial ownership, a business model description, often a volume projection. For a pre-revenue SaaS product this is the difference between accepting a first payment this week and accepting one next quarter.

A non-custodial API never takes possession. Funds settle from the payer to an address you control, and the provider’s role is limited to generating the payment request, watching the chain, and telling your backend what happened. Aurpay works this way: the merchant holds the keys and the provider never sits in the flow of funds. There is no account balance to withdraw from, which removes an entire class of integration work — no withdrawal endpoints, no balance reconciliation against an off-chain ledger, no waiting on a payout batch.

The tradeoff is worth stating plainly. Non-custodial means nobody can convert your incoming USDT to dollars for you, and nobody can reverse a payment sent to the wrong address. Custodial providers can do both, because they control the account. If the distinction between the layer that quotes a price and the layer that holds the asset is not yet crisp, the difference between checkout and settlement is the prerequisite reading.

Fee structure: the headline rate is the smallest number you will pay

Every provider advertises a percentage. Almost none of them advertise the second and third charges that land on the same transaction. Here is what the six publish, checked 21 September 2026.

Provider	Custody of incoming funds	Published rate	Source
Aurpay	Non-custodial — settles directly to merchant wallet	0.8% per transaction, flat, no tiers	aurpay.net
BitPay	Custodial, settles to bank or crypto	2% + $0.25 under $500,000/month; 1.5% + $0.25 to $999,999; 1% + $0.25 above $1M. “Higher fees applicable for high-risk industries”	bitpay.com/pricing
NOWPayments	Custodial balance or forwarding to your own wallet	“1% for payments without exchange”; “1.5% for multi-currency payments, Fixed rate payments and ‘fee paid by user’ payments”	nowpayments.io help centre
CoinPayments	Custodial, plus a separate non-custodial product	“Payment fees range from 0.2%–1.0% based on your monthly processing volume”	coinpayments.net
Triple-A	Custodial, licensed payment institution	1% flat on payments and payouts, reducible by volume on request	triple-a.io
Coinbase Commerce	Custodial merchant balance; auto-converts to USDC	1% widely reported; Coinbase’s own pricing page returned HTTP 403 to our check, so we mark this unverified	Not retrievable 2026-09-21

Two cells there matter more than the numbers. NOWPayments’ own help centre now states 1% and 1.5%, while 2026 review articles still repeat 0.5% and 1%. CoinPayments’ own site states a 0.2%–1.0% volume band, while third-party reviews report a flat 0.5% for coins and 1% for tokens. Build a pricing model off a comparison post rather than the vendor’s own page and you will likely be wrong by a factor of two.

Selection guidance: below roughly $100,000 per month, Aurpay’s flat 0.8% and CoinPayments’ volume band are the only rates that beat 1%, and CoinPayments reaches its floor only at volumes where BitPay’s top tier also applies. Above $1M, negotiate — every custodial provider here discounts on request and none publish the floor. For a merchant-facing version of this arithmetic including chain costs, see the gateway fee comparison.

“Supported chains” means at least three different things

A support matrix that lists twenty chains is usually conflating three distinct capabilities: displaying a price in that asset, accepting a payment on that chain, and settling to you in that asset on that chain. Providers that auto-convert do the first two and never the third.

Coinbase Commerce is the clearest example. Coinbase’s own onchain payment protocol accepts wallets and tokens across the Ethereum, Polygon and Base ecosystems, and then automatically converts the customer’s crypto to USDC. You are never holding the asset the customer paid with. BitPay settles in local currency, cryptocurrency, or a combination. Triple-A accepts Bitcoin, Ethereum, USDC and USDT and funds accounts in USD, EUR, SGD and 30+ local currencies.

Aurpay does not convert. It supports BTC, Bitcoin Lightning, ETH, USDT on ERC-20 and TRC-20, USDC on ERC-20 and TRC-20, DAI on ERC-20, and BNB, across Ethereum, Tron, Bitcoin mainnet and Lightning. What arrives in your wallet is what the customer sent. That is narrower than a provider advertising forty assets, and narrow on purpose: every listed pair is one the merchant actually receives.

The chain choice also carries a cost that has inverted recently. We measured live stablecoin transfers in September 2026 and found ERC-20 transfers costing around $0.02 while TRC-20 transfers cost between $2.11 and $4.36 — roughly two orders of magnitude the opposite way round from the industry’s standing assumption. This was historically true in reverse; Ethereum gas fell and TRX appreciated, and the relationship flipped. If your checkout defaults customers to Tron because a 2023 blog post said it was cheaper, you are now routing them to the expensive option. Methodology and per-transfer figures are in our measured ERC-20 vs TRC-20 fee comparison.

The API capability table

This is the table to bring to the design review. Every cell is either a primary-source value or an explicit gap, checked 21 September 2026.

Capability	Aurpay	BitPay	Coinbase Commerce	NOWPayments	CoinPayments	Triple-A
Merchant availability	No regional restriction published	No regional restriction published	Restricted. Legacy self-custody Coinbase Commerce was permanently shut down for merchants outside the United States and Singapore on 31 March 2026, with no extension and no migration path elsewhere. Its successor, Coinbase Business, is custodial and US/Singapore only	No regional restriction published	No regional restriction published	No regional restriction published
Testnet / sandbox	Yes — separate developer environment on testnet with its own API keys	Yes — test.bitpay.com	Not published in the official SDK	Not published	Not published	Not published
Payout API (send, not just receive)	Yes — payin and payouts both documented	Yes — dedicated Payouts resource	No — official SDK exposes Checkout, Charge, Event only	Not verified	Not verified	Yes — payouts API for payee-initiated withdrawals
Webhook retry policy published	Callbacks on every order status change; simple and signature-authenticated variants documented	Partially — “multiple times until the send is either successful or the BitPay server gives up”; count not published	Signed webhooks; retry policy not published	Not published	Not published	Not published
Manual webhook replay endpoint	Not published	Yes — POST /invoices/:invoiceId/notifications	Not published	Not published	Not published	Not published
Published rate limits	Not published	Not published	Not published (SDK surfaces a 429 error type)	Not published	Not published	Not published
Importable API collection	Yes — Postman collection	Yes — full reference plus llms.txt index	Official Node/Python/PHP SDKs	Postman-hosted documentation	Not verified	Postman collection referenced

A note on that cell, held to the same standard as the pricing table: Coinbase’s transition notice at help.coinbase.com/en/transitioning-from-coinbase-commerce-to-coinbase-business returned HTTP 403 to our check on 21 September 2026, as its pricing page did. The shutdown date and the two-country restriction are therefore cross-referenced from that help-centre URL plus several independent migration guides, not quoted from a page we could retrieve. Verify against your own account before planning around it.

Selection guidance: if you are a merchant outside the United States or Singapore, strike the Coinbase row before you start comparing, not after — the legacy product is gone and the successor will not accept you, so its fee and API characteristics are irrelevant to your decision. For everyone else, if your integration needs to send funds as well as receive them — affiliate payouts, refunds, marketplace disbursement — Coinbase drops out anyway, because charges and checkouts are its whole surface. Add a requirement for a documented testnet and the list shortens to Aurpay and BitPay, at which point the choice is custody model and fee.

Testnet quality is the cheapest signal you can get

An hour against a sandbox tells you more about a provider than a week of reading marketing pages. Create a payment request, underpay it deliberately, overpay it, let it expire, and send the right token on the wrong chain. A mature API returns distinct states for all five. An immature one returns a generic failure and leaves you to reconstruct events from a block explorer.

Aurpay publishes a developer environment running against testnet networks and testnet full nodes, with API keys generated separately from production. BitPay publishes test.bitpay.com alongside production. For the other four we found no documented sandbox on their public developer sites — which does not prove none exists, but does mean an engineer cannot start today without a sales conversation.

Run the underpayment and wrong-network cases specifically: they are the two failure modes that reach your support queue in the first month, and handling differs sharply between providers. Our standard operating procedure for underpaid, overpaid and wrong-network transfers gives you the scenarios to replay.

Webhook retry semantics: read what is published, assume nothing else

This is where published documentation thins out fastest. BitPay is the most forthcoming and still only says its server “attempts to send IPNs multiple times until the send is either successful or the BitPay server gives up,” expects an HTTP 200 with an empty body, and treats any other response as a failed delivery. No retry count. No backoff schedule. No dead-letter behaviour. Its compensating control is a resend endpoint you can call yourself. Coinbase signs its webhook events but publishes no retry policy. The remaining four publish nothing we could find.

Design as if every provider will deliver each event an unknown number of times, out of order, and occasionally not at all. That means idempotency keys on your handler, a reconciliation poll as a backstop, and an alert when an order sits in a pending state past its expiry window. Those mechanics are the subject of our webhook and reconciliation implementation guide. For selection purposes the point is narrower: a provider that publishes nothing is asking you to build the safety net yourself, and you should price that work into the comparison.

Payout API: the dimension most comparisons skip

Many crypto payment APIs are payin-only. That is fine for a pure checkout and a problem the moment you need to send money out — refunds, affiliate commissions, contractor payments, marketplace splits. Retrofitting outbound transfers onto a payin-only provider means running a second wallet and a second set of key-management controls, which is where most of the real security work lands.

Of the six, Aurpay, BitPay and Triple-A document outbound transfers. Coinbase Commerce’s official SDK does not expose one. Decide this before you write the first line of integration code, because the cost of adding it later is not an endpoint — it is an operational process with signing keys, approval steps and an audit trail.

What Aurpay cannot do

Three limits matter enough that you should know them before you shortlist us, not after.

There is no MCP server. If your architecture assumes an AI agent will call a payment tool over Model Context Protocol, Aurpay does not currently expose one — you would be calling the REST API directly from your own tool definitions.

There is no fiat conversion. Aurpay settles in the asset the customer paid with, to a wallet you control. “Stablecoin settlement” on our site means settlement denominated in stablecoins, not automatic conversion to dollars. If your finance team needs USD in a bank account on a schedule, you will be moving funds to an exchange yourself, and a custodial provider like BitPay or Triple-A may genuinely be the better fit. We would rather you knew that now.

There is no card-on-file equivalent, because the chain has no such mechanism. No crypto payment API can silently debit a customer’s wallet every month the way a card network can. This is not a product gap but a property of self-custodied assets, and any provider implying otherwise is either holding the customer’s funds custodially or describing a wallet-signature scheme with different consent semantics. For SaaS it is the biggest architectural consequence of accepting crypto, and it changes your billing model rather than your integration. We wrote up the five workable patterns — annual prepay, credit balance drawdown, invoice-and-remind, usage billing, and hybrid — in the guide to accepting stablecoin payments without recurring billing. Read it before you commit to a provider, because if none of those five models fits your pricing, no API on this list solves your problem.

A one-afternoon selection procedure

You do not need a two-week evaluation. You need four hours and discipline about where the numbers come from.

Start by writing down whether you need outbound transfers. That single answer eliminates a third of the market. Then decide custody: if you cannot absorb a multi-week onboarding, you need a non-custodial provider, and if you need fiat in a bank account, you need a custodial one. You rarely get both.

Next, pull every fee number from the vendor’s own pricing or help page and record the URL and the date. Do not use comparison articles, including this one, as your source of record — as the NOWPayments and CoinPayments cells show, secondary sources go stale within months and drift in the direction that flatters the vendor.

Finally, spend the remaining two hours in whichever sandboxes exist, running the underpay, overpay, expire and wrong-network cases, and score each provider on whether it returns a distinct, documented state. Then pick. If you are evaluating for a subscription product, the SaaS-side gateway evaluation covers the commercial and billing-model questions this technical comparison deliberately left out.

Aurpay is a non-custodial crypto payment API at a flat 0.8% per transaction, with a testnet developer environment, documented payin and payout endpoints, and status callbacks on every order transition. Funds go from your customer to your wallet with no intermediate account and no onboarding queue. Read the API documentation and run the four failure cases yourself before you talk to anyone. If the SaaS billing model is your open question rather than the integration, start with the gateway selection guide for subscription businesses instead.