Developers
hooks, webhooks, REST.

01Developer hooks

Put customisations in a must-use plugin (how) or your own plugin, never in CryptoMeter's files.

Examples

<?php
/**
 * Plugin Name: CryptoMeter customisations
 */

// 1. Recognise an extra AI crawler (appears in the AI training group).
add_filter( 'cryptometer_bots', function ( $bots ) {
	$bots['examplebot'] = array(
		'name'   => 'ExampleBot',
		'vendor' => 'Example Inc.',
		'match'  => 'ExampleBot', // case-insensitive user-agent substring
		'type'   => 'training',   // training | search_ai | agent | search
	);
	return $bots;
} );

// 2. Do not log requests to a health-check URL.
add_filter( 'cryptometer_log_request', function ( $log, $client ) {
	$uri = isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : '';
	return false === strpos( $uri, '/healthz' ) ? $log : false;
}, 10, 2 );

// 3. Count visits from another AI assistant.
add_filter( 'cryptometer_referral_vendors', function ( $vendors ) {
	$vendors['example'] = array(
		'label'      => 'Example AI',
		'hosts'      => array( 'chat.example.ai' ),
		'bot_vendor' => 'Example Inc.', // compare with bots of this vendor
		'bots'       => null,           // or an explicit list of bot ids
	);
	return $vendors;
} );

// 4. Add a section to /llms.txt.
add_filter( 'cryptometer_llms_txt', function ( $txt ) {
	return $txt . "\n## Licensing contact\n\nlicensing@example.com\n";
} );

Hook names and arguments were checked against the code. Examples 2 and 3 were reviewed, not run. The referral beacon script lists the vendor hosts when the page is rendered, so a vendor added with the filter is included automatically.

02Webhooks and signatures

After every settled Monetize payment CryptoMeter sends a JSON POST to your webhook URL (Settings → Notifications). Only https://; private and internal addresses are refused (WordPress "safe" HTTP API); redirects are not followed; sent in the background with a short timeout and not retried (use the ledger or CSV as the source of truth). Headers: Content-Type: application/json, User-Agent: CryptoMeter/1.0.0, X-CryptoMeter-Event (payment.settled or test) and, with a secret, X-CryptoMeter-Signature: sha256=<hex>.

{
  "event": "payment.settled",
  "id": "423618ba-fa43-48b0-b59e-4d8acd8b362b",
  "created_at": "2026-09-23T09:59:28+00:00",
  "mode": "test",
  "site": "https://your-site.example/",
  "post": { "id": 4, "title": "Your post", "url": "https://your-site.example/your-post/" },
  "amount_usdc": "0.01",
  "network": "eip155:84532",
  "network_label": "Base Sepolia (testnet)",
  "transaction": "0x...",
  "explorer": "https://sepolia.basescan.org/tx/0x...",
  "payer": "0x...",
  "bot": "GPTBot",
  "bot_type": "training"
}

The test button sends "event": "test". The weekly report and spike alert are e-mail only; they are not sent to the webhook.

Verify the signature

HMAC-SHA256 of the raw body with your secret, in hex, prefixed with sha256=. Compare in constant time.

<?php
// webhook-receiver.php on YOUR server (not inside WordPress).
$secret   = getenv( 'CRYPTOMETER_WEBHOOK_SECRET' );
$body     = file_get_contents( 'php://input' );
$sent     = isset( $_SERVER['HTTP_X_CRYPTOMETER_SIGNATURE'] ) ? $_SERVER['HTTP_X_CRYPTOMETER_SIGNATURE'] : '';
$expected = 'sha256=' . hash_hmac( 'sha256', $body, $secret );
if ( ! hash_equals( $expected, $sent ) ) {
	http_response_code( 401 );
	exit( 'bad signature' );
}
$event = json_decode( $body, true );
http_response_code( 200 );
echo 'ok';

// receiver.mjs (Node.js, no dependencies)
import http from 'node:http';
import crypto from 'node:crypto';
const SECRET = process.env.CRYPTOMETER_WEBHOOK_SECRET;
http.createServer( ( req, res ) => {
	const chunks = [];
	req.on( 'data', ( c ) => chunks.push( c ) );
	req.on( 'end', () => {
		const raw = Buffer.concat( chunks );
		const expected = 'sha256=' + crypto.createHmac( 'sha256', SECRET ).update( raw ).digest( 'hex' );
		const sent = String( req.headers[ 'x-cryptometer-signature' ] || '' );
		const ok = sent.length === expected.length &&
			crypto.timingSafeEqual( Buffer.from( sent ), Buffer.from( expected ) );
		if ( ! ok ) { res.writeHead( 401 ).end( 'bad signature' ); return; }
		const event = JSON.parse( raw.toString( 'utf8' ) );
		console.log( event.event, event.amount_usdc, event.transaction );
		res.writeHead( 200 ).end( 'ok' );
	} );
} ).listen( 8787 );

Both receivers were tested against a signature produced by the plugin's code in the earlier verification round (2026-09-23); the signing code is unchanged in this version.

03Public files and REST API

Public files

Verified on a test install: /llms.txt 200; /license.xml and /.well-known/tdmrep.json 404 by default and 200 after switching them on.

REST API

Namespace /wp-json/cryptometer/v1 (with plain permalinks: /?rest_route=/cryptometer/v1/…).

Core WordPress REST API and oEmbed: bots set to Block get HTTP 403 with your block message from every /wp-json/wp/v2/… and /wp-json/oembed/… route, the CryptoMeter catalog and the article API. For charged bots (Monetize), /wp-json/wp/v2/… of metered post types returns a teaser with content.protected: true and content.x402 pointing to the paid endpoint.

04External services and privacy

CryptoMeter contacts these services. No data about your visitors is sent. Requests identify themselves as CryptoMeter/<version> (WordPress; <your site URL>). Every request has a timeout, and a failure never affects your visitors (the last good copy is kept).

Terms: those of each vendor's or service's website. The admin app and this documentation load no external fonts or scripts.

What is stored

An IP network prefix and a payer wallet address can count as personal data in some jurisdictions; mention them in your privacy policy if that applies to you (see the suggested text under Settings → Privacy).