Security
Every layer of protection available to your shop, in one place: for API requests, for webhooks, and for the dashboard account.
API requests from your server
These layers decide whether a request, a withdrawal above all, is accepted.
| Layer | What it does | Where to set it up |
|---|---|---|
| Request signaturerequired | Every request carries an HMAC-SHA256 computed with your secret. A request whose signature does not match is refused. | In your code, on every request |
| API IP Whitelist | Withdrawal requests are accepted only from the IPs you have added. Any other IP receives 403 with code 2003. | Dashboard: Developer page, API IP Whitelist card |
| Client certificate (mTLS) | The API key works only from a machine that holds your certificate, so a leaked key cannot be used anywhere else. | Send a CSR to our team |
| Withdraw verify | Before a withdrawal is created, the system asks your server to approve it. If your server does not answer 200, no withdrawal is created. | Dashboard: Developer page, Webhook settings |
| API key rotation | Each agent has one active API key. Rotating it cancels the old key immediately, and the new secret is shown only once. | Dashboard: Developer page, API Keys |
Webhooks sent to your server
These layers let you confirm that a webhook really comes from the system before you update a balance.
| Layer | What it does | Where to set it up |
|---|---|---|
| Webhook signature | Each webhook carries X-Signature. Compute it again with your webhook secret and compare before trusting the data. | In your webhook handler |
| Webhook source IPs | Webhooks are sent from a fixed list of IPs, so your firewall can accept webhooks from those IPs only. | On your firewall |
Your dashboard account
These layers protect actions taken by a person in the dashboard, such as withdrawing from assets or changing settings.
| Layer | What it does | Where to set it up |
|---|---|---|
| Authenticator App | A code from the authenticator app is required to sign in and to confirm sensitive actions. | Account, Security settings |
| 6-digit PIN Code | Confirms transactions such as withdrawing from assets, adding a whitelisted wallet and swapping coins. It comes with a backup phrase for resetting the PIN. | Agent settings, Security tab |
| Destination whitelist | Withdrawals from the dashboard can go only to bank accounts or wallets that the agent owner has registered in advance. | Agent menu: Whitelist Ebank and Whitelist Address |
| Pause after a credential change | After a password, PIN, authenticator or App Secret Verify change, withdrawals are paused for a while. Creating a new App Secret Verify pauses API withdrawals for 24 hours (code 6026). | Automatic |
| Activity log | Records changes such as additions to the API IP whitelist and the destination whitelists, so you can review who changed what. | Agent menu: Activity |
If you think a key has leaked
- 1Rotate the API key on the Developer page of the dashboard. The old key stops working immediately.
- 2Update the new key and secret on every server of yours that calls the API.
- 3Please tell our team. If the key uses mTLS and a server may have been compromised, ask us to revoke the certificate as well.