Non-custodial keys
Public extended keys or supported descriptors are used for receiving-address derivation; private keys are not part of the normal payment collection path.
Security
BitPayPal is designed around a non-custodial receiving model: merchant private keys are not required for ordinary address derivation. Payment state is reconciled through provider quorum, confirmation rules and signed webhook events.
Signed webhooks
Events carry an event ID, timestamp and HMAC signature. Receivers should enforce freshness and durable replay protection.
Provider consensus
Configured quorum rules distinguish provider outage and conflict from genuine blockchain state changes.
Dashboard security
Team permissions, CSRF protection, rate limiting, TOTP and passkeys protect merchant operations.