Security

Money

• Payouts go only to the addresses in your payout rules. The platform’s own deposit address can never be one of them.
• A payment is credited only once the network has firmly confirmed it.
• If the block with a payment is rolled back, the payment is marked orphaned and stays out of payouts.

Access

• Two-factor sign-in with an authenticator app and recovery codes.
• Issuing an API key or changing payout addresses takes a fresh code from the app, or your password if two-factor is off.
• A session list with devices and sign-in times. You can end any of them.
• Platform admin actions are written to an audit log.

Notifications to your website

Every payment notification CoinsPay sends to your website is signed with your shop’s secret key. Your site checks the signature, so a forged payment or a replayed old notification won’t get through. The Developers page shows how to check it in code.

An API key works for its own shop only and can’t see other shops’ payments or invoices. A revoked key stops working at once.

Data

Two-factor secrets and notification signing keys are stored encrypted. Notification and Telegram logs are deleted after a month.