Keeping it safe
The controls on your account, why each exists, and what to reach for when something has gone wrong.
Whoever holds this account can change where your money is sent. These are the controls that exist, why each one is there, and the ones you should not switch off.
Two-factor is required
For owners, admins and finance users it is not a preference. Those roles can re-point settlement and create live keys, which makes them exactly the accounts worth phishing a password for. You cannot authorise anything until you have enrolled, and you cannot then turn it off.
Save the recovery codes somewhere that is not the phone holding the authenticator.
Anything that moves money asks again
Adding a settlement destination, creating a key, changing a webhook URL: each needs your password re-entered, and your second factor with it. A stolen session on its own is not enough.
Roles
| Role | Can |
|---|---|
owner | Everything, including settlement and closing the account. |
admin | Settings, keys, webhooks, refunds. |
finance | Refunds, captures, statements. |
developer | Test keys, webhook logs, read live payments. |
support | Read payments and receipts. |
readonly | Read. |
Give people the least that lets them do their job. A developer who cannot change your settlement address cannot have that access stolen from them.
The inbox is the root of trust
Whoever can read the account's email can take the account back through a password reset. That is deliberate — without it, somebody could register an address they do not own and hold it forever.
It also means the email account needs to be at least as well protected as this one, and that changing the address here requires confirmation from the new inbox while the old one is told it happened.
If a key leaks, revoke it. Do not rotate it.
Rotation issues a new secret while the old one keeps working through an overlap window — exactly the wrong behaviour when somebody else has it. Revoking kills both halves immediately, and every integration using it stops within seconds. That is the intended outcome.
The emergency stop
On the Security page. It revokes every API key, ends every session and suspends the account so nothing new can be created. Reopening takes a conversation with us.
It does not reverse payments already on chain and does not change your settlement address, because neither was ever ours to touch.
What we do on our side
- Requests are signed rather than bearing a reusable token, so an intercepted one cannot be replayed or edited.
- Secrets are encrypted at rest and shown exactly once.
- Settlement contracts have no owner, no admin key and no upgrade path. We cannot move your funds even if we wanted to.
- Webhook endpoints are checked to be public internet hosts, so this API cannot be turned into a proxy into anyone's network.
- Every consequential action is written to an audit log you can read.
Reporting something
If you find a vulnerability, tell us before you tell anyone else and we will work with you. We would rather hear it from you than read it somewhere.