Feature · Auto Payout ▓ THRESHOLD → SWEEP → COLD Zero manual clicks

Set a threshold.
Walk away.

Define a per-coin balance threshold and a destination. The 5-minute worker tick checks every merchant every round; the moment your balance crosses the line, we sign + broadcast a payout to your address. 30-minute post-fail cooldown prevents retry loops. TOTP-gated at rule-create time.

Create account → Read the spec

Automatic · Safe · Audit-logged

§ Part I / IV · Rule shape

A rule is four fields.
That's the whole DSL.

Minimal
Because payout primitives shouldn't be configurable

SymFieldWhat it doesExample

CcoinWhich balance to watch. One rule per (merchant, coin). Rules for different coins fire independently.BTC, USDT_TRC20, TON

Tthreshold_nativeBalance in the native coin unit. When balance ≥ threshold, a payout is created for the full balance minus network fee.0.01 BTC · 500 USDT

DdestinationValid coin-specific address. Format-validated + burn-checked at rule creation; cold-wallet addresses are the normal use case.bc1q… · TR7N… · UQDk…

EenabledBoolean. Disable to pause without losing the rule. Disabled rules are kept in the dashboard with a visible DISABLED chip.true / false

§ Part II / IV · Safety rails

What we checked
before we shipped this.

Guards
Payout primitives have to be right

SymGuardWhyEnforced

CD30-min cooldown on failureFailed auto-withdraws block that coin's rule for 30 minutes. Prevents the worker from re-triggering into a hot wallet drain if a downstream broadcast keeps rejecting.LIVE

TTTOTP at rule-createCreating or updating a rule requires a current TOTP code. The 2FA check is separate from per-payout TOTP; a compromised JWT can't point your sweep at an attacker address.LIVE

VALBurn + format validationDestination is validated against the chain's address rules at rule-create time. Known burn addresses rejected. Same checks as /v1/payout.LIVE

LOGAuto-Withdraw event webhookEvery fire emits payout.auto_withdraw with event_id + signed receipt, same delivery contract as every other webhook.LIVE

LIMOne rule per coinAvoids rule-order ambiguity. If you need per-storefront destinations, use Auto-Settle + per-merchant wallets instead.LIVE

§ Part III / IV · Example

Drain BTC > 0.01
to a cold wallet. One curl.

API
Dashboard toggle does the same

PUT /dashboard/auto-withdraw-rulesBearer auth · 200 OK

// Sweep every 0.01 BTC to a cold wallet the moment it lands.
curl https://orbchain.io/dashboard/auto-withdraw-rules \
  -X PUT \
  -H "Authorization: Bearer <jwt>" \
  -H "X-TOTP: 123456" \
  -H "Content-Type: application/json" \
  -d '{
    "rules": [{
      "coin":             "BTC",
      "threshold_native": "0.01",
      "destination":      "bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq",
      "enabled":          true
    }]
  }'

// 3h later — balance reaches 0.012 BTC:
// worker fires:   payout.auto_withdraw (event_id 01H…)
// hot wallet:     0.012 → 0 BTC (minus fee)
// cold wallet:    +0.01198 BTC

§ Part IV / IV · Questions

Things merchants
ask before enabling.

Answered
In full, with links

Q.01Do I need to run a cron on my side?

No. The 5-minute tick is our worker; nothing runs on your side. Disable a rule from the dashboard any time and the next tick honors it.

Q.02What happens if the broadcast fails?

Your balance is refunded (atomic) and the rule goes into a 30-minute cooldown. A payout.failed webhook fires so you can alert your ops channel. After cooldown the next tick retries, assuming the balance still exceeds the threshold.

Q.03Are network fees deducted from the payout or our balance?

From the payout. You receive balance - network_fee. The 0.4% platform fee is already out the door at deposit time; auto-withdraw carries no additional platform fee.

Q.04Can I run this on Lightning?

Not yet. LN payouts require a specific destination (BOLT11 or Lightning Address) per payout — a single standing destination doesn't map cleanly. We'll revisit once LNURL-withdraw support matures.

Q.05Where are rules audited?

Every create / update / delete is logged in our admin audit table. From the merchant dashboard you see the current rule set + the last-fired timestamp per rule.

Balance in.
Cold storage out.
Automatic.

Running a custody script against a gateway's API is work no merchant should do. We did it once, for everyone.

Create account → Read the spec

§ Feature stack · Auto Payout

Auto Payout is a pillar,
but every pillar supports it.

Deterministic + safe
Audit-logged

SymFeatureMechanismStatus

LNInstant LightningAccept and pay out Bitcoin over Lightning. Atomic settlement, zero confirmations, sub-cent fees. On-chain fallback is one parameter.LIVE

ASAuto SettleCustomer pays any accepted coin. You always receive the settlement coin you configured — pay-with-BTC, get-USDT. Swap runs at checkout, no extra setup.LIVE

APAuto PayoutSet a balance threshold. We sweep to your cold wallet the moment you hit it. 30-minute cooldown on failure. No manual clicks, no scheduled cron.LIVE

SRSigned ReceiptsEvery PAID payment gets an Ed25519-signed receipt. Verify offline with our public key. No other gateway in our category ships this.LIVE

NKNo-KYC ForeverEmail + password, that's it. No documents, no verification wall, no volume gates. We don't touch your customers' identity — your gateway, your rules.LIVE

DWDeterministic WebhooksEvery webhook carries a SHA-256 event_id derived from (event_type, entity_id). Retry 1,000×, same id. True idempotency without an extra DB column.LIVE

Set a threshold. Walk away.

A rule is four fields.That's the whole DSL.

What we checkedbefore we shipped this.

Drain BTC > 0.01to a cold wallet. One curl.

Things merchantsask before enabling.

Balance in.Cold storage out.Automatic.

Auto Payout is a pillar,but every pillar supports it.