Merchant settings and security
Manage checkout appearance, accepted tokens, API access, and team permissions.
Checkout appearance
Use Payment page to configure your logos, light and dark appearance, colors, and backgrounds. Preview the result before saving. A default return URL can send the customer back to your website; it is not proof of payment.
Accepted tokens
Use the merchant's accepted-token settings to choose which active tokens are offered for new invoices. Availability also depends on the pricing currency and network. Existing issued instructions can remain visible even after a token is removed from the offered list.
Team permissions
The owner manages team invitations and independent permissions. Viewing balances, creating invoices, viewing an API key, and rotating a key are separate capabilities. If an action is unavailable, ask the owner to review your access.
API and webhook secrets
Keep API credentials on your server. Restrict who can reveal or rotate them. API keys and webhook signing secrets have different purposes; do not assume their values are equal. See API authentication and webhook verification.
If API source restrictions are enabled for the merchant, requests must originate from an allowed source address. An otherwise valid signature can receive 403 API_SOURCE_NOT_ALLOWED.
Webhook URL
Configure and inspect webhook deliveries in merchant settings. For invoices created through the API, explicitly pass webhook_url in each creation request. The saved merchant setting is not automatically copied into those requests.
Protect your own account with the available email/TOTP controls in account settings. Never share a session cookie with an external integration.