Account, custody, and payment security
Understand the controls in the BluPay payment workflow and the steps your business needs to take when managing credentials, receiving webhooks, and withdrawing funds.
Custody and withdrawals
- BluPay is custodial: payment wallets are managed by the platform rather than by the merchant. A balance in the dashboard is not a wallet whose private keys the merchant controls.
- Withdrawal requests require an enabled authenticator and a valid time-based one-time password (TOTP). The service checks the destination, available balance, configured minimum, and network fee.
- A withdrawal request enters a review workflow before it can be broadcast. Completion depends on the transaction being confirmed on the selected network.
Accounts and credentials
- TOTP two-factor authentication can be enabled for account login and is required for withdrawal authorization. Use a unique password and protect the device that generates your codes.
- The authentication service hashes passwords with bcrypt and encrypts stored TOTP secrets with AES-256-GCM.
- API credentials are associated with a merchant and shop. An optional source IP allow-list can restrict where a key is used; keep keys on your server and revoke credentials that are no longer needed.
Payment notifications and records
- Webhooks include an HMAC-SHA256 signature and timestamp. Verify the signature against the exact raw request body and your shop’s webhook secret.
- A signature check must be combined with a timestamp check and duplicate-event handling. A redirect to your success page or a customer’s screenshot is not payment confirmation.
- Invoice and ledger records support reconciliation of payments, fees, balances, and withdrawals. Match those records to your own order references before fulfillment.
Check before processing live payments
Test notification verification and order handling in the sandbox, then confirm the current network, asset, and withdrawal settings for your shop. Security controls reduce risk; they do not eliminate the risks of account compromise, service outages, or blockchain transfers.
Follow the webhook verification guide and the API documentation for integration details.
Found a vulnerability?
We welcome reports from security researchers. Email support@blupay.me with the affected URL or feature, a description of the impact, and reproduction steps using your own account or test data. Do not include passwords, private keys, API secrets, or another person’s personal information.
Avoid accessing accounts or data that are not yours, disrupting the service, or moving funds as part of a report. Contact us before sharing sensitive technical evidence so that an appropriate channel can be agreed. This page does not offer a bug bounty or promise a fixed response time.