Payment security

API credentials

API keys are generated in the merchant’s browser and stored by Unsu only as SHA-256 hashes. The plaintext key cannot be recovered. A lost key must be rotated, which invalidates the previous key.

Merchant wallet addresses

Merchants supply their receiving wallet addresses when creating an invoice. The invoice snapshots those addresses so checkout does not depend on mutable browser input.

Payment confirmation

• Payment settlement is performed by the Unsu confirmation worker.
• Browser status polling is informational and cannot mark an invoice paid.
• A blockchain transaction cannot be reused to settle another invoice.
• Merchants fulfill only after the authenticated API reports PAID.

Report a security issue

Send a concise technical report to [email protected]. Include the affected endpoint, reproduction details, and impact without including customer payment data.