Feature · Scoped API keys ▓ SCOPES · COIN · IP · AUDIT Not three flat keys per merchant

N keys. Per-scope.
Rotate one at a time.

Most gateways give you three flat keys and hope you never rotate them. We give you unlimited named keys, each with its own scopes, coin allowlist, IP allowlist, webhook secret, and audit log. Rotate one storefront's key without rotating the others. Revoke a leaked key in one click.

Create account → Read the spec

Scoped · Restricted · Revocable

§ Part I / IV · What's on every key

Five controls per key.
All enforced at auth-time.

Per-key
Not "per-merchant"

SymControlWhat it doesExample

SCOScopesPer-key allowed capabilities. Principle of least privilege — give your storefront payment:create, nothing else.payment:create, payout:create, payment:read, balance:read, admin

CACoin allowlistPer-key coin restriction. A Lightning-only storefront key can't mint an ETH invoice even if compromised.["BTC_LN"] or ["*"]

IPIP allowlistCIDR blocks the key accepts traffic from. Backend-only keys live-in-datacenter; they should never accept calls from anywhere else.["10.0.0.0/24", "192.0.2.17/32"]

WSWebhook bindingEach key owns its own webhook URL + HMAC secret. Rotating a key rotates the webhook endpoint association cleanly.per-key hmac, not merchant-wide

LOGAudit logEvery call made with a key is logged with timestamp, IP, route, status. Filter by key to see exactly what it did.GET /dashboard/api-keys/:id/events

§ Part II / IV · Why it matters

The flat-keys problem
most gateways haven't fixed.

Competitive gap
We did

SymGatewayKeys per merchantScopes

ORBOrbChainUnlimited named keys. Each key gets its own scopes / coin / IP / webhook / audit log.YES

OXAOxaPayOne merchant API key + one payout key. Can't separate the admin dashboard API from a storefront integration.NO

NOWNowPaymentsSingle API key per merchant (re-generatable). No per-key scopes or allowlists in the public API.NO

PLIPlisioMerchant + store keys. Store-level isolation but no scope / coin / IP controls at the key level.PART

CRYCryptomusPublic + private merchant API keys. No per-key scopes or audit log surfaced to merchant.NO

§ Part III / IV · Example

Create a storefront-only key.
One curl.

Code
Dashboard UI does the same

POST /dashboard/api-keysBearer auth · 200 OK

// Create a scoped key for one storefront — Lightning-only, backend IP allowlisted.
curl https://orbchain.io/dashboard/api-keys \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "label":             "storefront-a",
    "scopes":            ["payment:create", "payment:read"],
    "coin_allowlist":    ["BTC_LN", "USDT_TRC20"],
    "ip_allowlist":      ["10.0.0.0/24"],
    "webhook_url":       "https://shop.example/webhooks/orbchain"
  }'

// response — key value is returned once, never again.
{
  "id":               "key_01H8KP…",
  "label":            "storefront-a",
  "key":              "mk_live_abcd…",   // store it now
  "webhook_secret":   "whsec_…",
  "scopes":           ["payment:create", "payment:read"]
}

§ Part IV / IV · Questions

Things security
teams ask first.

Answered
In full, with links

Q.01What's the revocation SLA?

Immediate. POST /dashboard/api-keys/:id/revoke flips the key to revoked status; the next request with that key receives 401. No propagation window — we don't cache key state.

Q.02Can a key self-rotate?

Yes — POST /dashboard/api-keys/:id/rotate returns a fresh secret and rolls the old one into a 30-minute grace window so you can redeploy. After the grace window the old value 401s.

Q.03Is the audit log tamper-evident?

Append-only, with every row carrying the request_id and source IP at insert time. We don't expose a sign-every-row mechanism — if you need cryptographic receipts for API-key usage specifically, open a support thread and we'll scope it.

Q.04How many keys can I create?

No hard limit. Soft-rate-limit is 50 keys per account to prevent enumeration abuse — past 50, open a support thread.

Q.05Do coin / IP allowlists enforce on webhook deliveries too?

The key's webhook URL is SSRF-hardened (no private IPs accepted). The coin allowlist gates invoice creation, not delivery — every webhook is HMAC-signed regardless.

One leaked key.
One revoke.
Everything else stays up.

Flat-key gateways make you rotate the world when one integration goes wrong. We don't.

Create account → Read the spec

§ Feature stack · API keys

Scoped keys gate every
named feature below.

Per-key
Scope → feature

SymFeatureMechanismStatus

LNInstant LightningAccept and pay out Bitcoin over Lightning. Atomic settlement, zero confirmations, sub-cent fees. On-chain fallback is one parameter.LIVE

ASAuto SettleCustomer pays any accepted coin. You always receive the settlement coin you configured — pay-with-BTC, get-USDT. Swap runs at checkout, no extra setup.LIVE

APAuto PayoutSet a balance threshold. We sweep to your cold wallet the moment you hit it. 30-minute cooldown on failure. No manual clicks, no scheduled cron.LIVE

SRSigned ReceiptsEvery PAID payment gets an Ed25519-signed receipt. Verify offline with our public key. No other gateway in our category ships this.LIVE

NKNo-KYC ForeverEmail + password, that's it. No documents, no verification wall, no volume gates. We don't touch your customers' identity — your gateway, your rules.LIVE

DWDeterministic WebhooksEvery webhook carries a SHA-256 event_id derived from (event_type, entity_id). Retry 1,000×, same id. True idempotency without an extra DB column.LIVE

N keys. Per-scope. Rotate one at a time.

Five controls per key.All enforced at auth-time.

The flat-keys problemmost gateways haven't fixed.

Create a storefront-only key.One curl.

Things securityteams ask first.

One leaked key.One revoke.Everything else stays up.

Scoped keys gate everynamed feature below.