You are launching crypto processing for dozens of merchants. Each needs its own checkout with a logo, separate API keys, and billing. But building payment infrastructure from scratch takes months of development and millions in investment. A white-label crypto payment gateway solves this: you get a ready-made multi-tenant platform that you sell under your brand. Our engineers, with 10 years of blockchain development experience (Ethereum, Polygon, Arbitrum, Solana, L2s), have delivered 50+ such projects—from startups to enterprise. For example, one client—a crypto acquirer from Southeast Asia—launched the platform in 6 weeks and was processing 50,000 transactions per day within a month. We handle the full cycle: from architecture to deployment. We'll assess your task in 1 day—just contact us.
A common mistake is trying to adapt a single-tenant ledger, which leads to data isolation breaches and vulnerabilities. White-label architecture builds multi-tenancy from the start.
How to Build a Multi-Tenant White-Label Payment Gateway
Address Derivation Strategy — White Label Development
Each tenant gets its own master xpub, from which addresses for its merchants and orders are derived. The path structure:
m / purpose' / coin_type' / tenant_id' / merchant_id / order_index BIP32 (Hierarchical Deterministic Wallets) — the standard we use for secure derivation. Example for EVM networks:
import { HDNodeWallet } from "ethers"; class TenantWalletManager { private masterNode: HDNodeWallet; constructor(masterMnemonic: string) { this.masterNode = HDNodeWallet.fromPhrase(masterMnemonic); } getTenantXpub(tenantId: number): string { return this.masterNode .deriveChild(44 + 0x80000000) .deriveChild(60 + 0x80000000) .deriveChild(tenantId + 0x80000000) .neuter() .extendedKey; } getDepositAddress(tenantXpub: string, merchantId: number, orderIndex: number): string { const tenantNode = HDNodeWallet.fromExtendedKey(tenantXpub); return tenantNode .deriveChild(merchantId) .deriveChild(orderIndex) .address; } } This allows tenants to independently verify addresses but not gain control over master keys.
How to Ensure Data Isolation?
Instead of separate databases, we use row-level security—simpler to operate:
ALTER TABLE payments ENABLE ROW LEVEL SECURITY; CREATE POLICY tenant_isolation ON payments USING (tenant_id = current_setting('app.tenant_id')::uuid); SET LOCAL app.tenant_id = '...'; For high loads (100+ tenants), we use a separate schema per tenant via search_path. This isolation guarantees that each tenant's data remains confidential. In production, this is the difference between "one incident" and "losing all clients."
Step-by-Step Tenant Setup
- Create a tenant in the admin panel.
- Specify the domain and branding.
- Generate API keys.
- Configure billing.
- Verify integration with a test payment.
Merchant API and Webhooks
Merchants integrate via REST API, similar to Stripe. Authentication uses a key pair (public + secret). Example invoice creation:
POST /api/v1/invoices { "amount": "99.99", "currency": "USD", "accepted_coins": ["ETH", "USDT_ERC20", "BTC"], "order_id": "order_123", "customer_email": "[email protected]", "success_url": "https://shop.example.com/success", "cancel_url": "https://shop.example.com/cancel", "metadata": { "product_id": "456" }, "expires_in": 900 } Webhook system with reliable delivery: 1min → 5min → 30min → 2h → 8h → 24h. After 6 failures, it is marked as failed with the option to manually retry from the dashboard. Each event is signed using HMAC-SHA256.
Checkout UI and Custom Domains
The frontend is fully customizable to the tenant's brand: primary color, logo, font, borderRadius, dark mode. When the checkout page loads, CSS variables are injected dynamically. Each tenant can use their own domain (e.g., pay.theirclient.com)—SSL is automatically configured via Let's Encrypt.
How is SSL configured for a domain?
After adding the domain in the tenant's admin panel, the system automatically verifies ownership via a DNS TXT or CNAME record. Let's Encrypt issues a 90-day certificate with auto-renewal. All transparent to the user.Billing, Security, and Compliance
| Model | Implementation |
|---|---|
| Percentage of volume | Deduction at sweep to hot wallet |
| Fixed fee per transaction | Add fee to amount or deduct at sweep |
| Subscription | Monthly access fee |
| Hybrid | Subscription + reduced percentage |
Security
- API keys: generated via
crypto.randomBytes(32), stored only as hash (sha256) - Rate limiting: separate limits per key (Redis + sliding window)
- IP whitelist: IP restriction for production
- Audit log: all admin actions in an immutable table
- AML: optional integration with Chainalysis or Elliptic
What's Included
- Architectural schema and documentation (OpenAPI, ERD)
- Source code repository with CI/CD
- Configured domains and SSL for each tenant
- Tenant team training (2–3 workshops)
- Launch support (2 weeks)
- Option for ongoing maintenance under SLA
Timeline and Stages
| Stage | Duration |
|---|---|
| Analysis and design | 1–2 days |
| Core Gateway Engine | 1–2 weeks |
| Merchant API and webhooks | 1 week |
| Checkout UI and theming | 1 week |
| Tenant management and billing | 1 week |
| Admin dashboard | 1–2 weeks |
| Testing and security review | 1–2 weeks |
Minimum MVP (5–6 networks, branded checkout, API) — 6–8 weeks. Full enterprise platform — about 3 months.
Why White-Label is More Profitable?
A white-label platform brings you to market 3–4 times faster than building from scratch. You get a proven architecture, tested security, and scalability without rewriting code. Compared to in-house development, you save up to 40% of the budget and 3–4 months of time. If you'd like to discuss your project, contact us—we'll assess your task in 1 day.