Security Guide for Businesses Accepting Crypto Payments
Accepting crypto removes chargebacks, but it adds responsibilities: keys that must not leak, transfers that cannot be reversed and a webhook that must not be fooled. This guide is the checklist we wish every merchant read before their first payment.
API keys and secrets
Your API key creates invoices in your name; your secret key proves webhooks are genuine. Treat both like passwords. Store them in environment variables or a secrets manager, never in source code, never in a public repository, never in a client-side bundle. If a key leaks, generate a new one from the dashboard and update your server immediately.
Server-side only
Every call to the create-invoice endpoint must originate from your server. A call from the browser exposes the key to anyone who opens developer tools. The same applies to mobile apps: route the request through your backend.
Webhook verification
Verify the HMAC-SHA256 signature over the raw body with a constant-time comparison, reject anything that does not match, and process each invoice id once. The webhook guide has code for Node.js, PHP and Python. Without this step, anyone can tell your server that an order is paid.
Amount checks
Decide prices on the server, never from a form field. When the webhook arrives, compare paid_amount with what you expected; for high-value orders, require the full amount before delivery. Underpayment within the gateway's small tolerance may still mark an invoice paid, so your own comparison is the final gate.
Wrong-network payments
USDT sent on Ethereum or BNB Chain to a TRON address is lost. The KriptoGo checkout page warns customers clearly; repeat the warning in your own checkout and in any email. If a customer reports a wrong-network transfer, explain calmly that it cannot be recovered by anyone; there is no support process that can reverse a blockchain transfer.
Withdrawals
Withdraw to an address you control and have tested with a small amount first. Copy addresses from your wallet, never from a chat message or email, and check the first and last characters after pasting. Clipboard-replacing malware exists; a hardware wallet or a wallet that shows the address on-device protects against it.
Dashboard account security
Use a long unique password for your KriptoGo account and your email account, since password resets go through email. Change the password if you suspect a leak; this signs out other sessions. Do not share the account; create separate projects instead.
Phishing and impersonation
KriptoGo will never ask for your secret key, your wallet seed phrase or a "verification payment". Emails about your account link only to kriptogo.com. Check the domain before signing in, and be suspicious of urgency ("your account will be closed in 24 hours").
Monitoring and logs
Log every webhook with its invoice id, signature result and outcome. Alert on repeated signature failures, which indicate probing, and on invoices that stay pending after payment claims. Reconcile your dashboard balance with your own order records weekly.
Incident response
- Rotate the leaked key or password immediately.
- Check recent invoices and withdrawals for anything you did not initiate.
- Review server access logs around the time of the leak.
- Fix the root cause (committed secret, exposed endpoint, weak password).
- Document what happened so it does not repeat.
Checklist
- Keys in environment variables, not in code or bundles
- Invoice creation only from the server
- Webhook signature verified, constant-time, idempotent
- Prices decided server-side; paid_amount checked
- Network warning shown in your UI
- Withdrawal address tested with a small amount
- Strong unique passwords for dashboard and email
- Logs and alerts for webhook failures
Summary
Most crypto merchant losses come from three avoidable causes: leaked keys, unverified webhooks and wrong-network sends. Handle those three and you are ahead of the majority of shops accepting crypto today.
Frequently asked questions
Can KriptoGo reverse a payment sent to the wrong network?
No one can. Blockchain transfers are final. Prevention through clear warnings is the only protection.
Should I rotate my API key regularly?
Rotate it whenever you suspect exposure, when a developer with access leaves, or after moving hosting. Routine rotation on a schedule is good practice but less important than keeping it out of code.
Is two-factor authentication available?
Protect the email account tied to your dashboard with two-factor authentication, since account recovery flows through it, and use a unique password for the dashboard itself.
Accept crypto payments in 30 minutes with KriptoGo
No setup fee, no monthly fee. Just 1% on successful payments.