The less access we have to your money,
the safer you are
Coinetic is built so that even if our servers were breached, an attacker couldn't spend or redirect your incoming payments.
Public keys only
Accepting payments takes just an xpub/zpub, a Solana address and a collection wallet address on EVM networks. Coinetic never asks for merchants' seed phrases or private keys; they're not in our code, our database or our logs.
Every address is checked three times
The customer's address is drawn from your wallet; on crediting, we verify it was derived from your key; and the database refuses to link it to anyone else's wallet.
EVM: sweeps go only to your address
On EVM networks, deposit addresses are smart contracts with the recipient fixed at deployment. No one can change it, including us.
Delayed wallet changes
Password, second factor, an email to the owners and a window to cancel. If someone gains access to your dashboard, you'll have time to stop the change.
Only the blockchain marks it “paid”
The network watcher changes the status after the required number of confirmations. Every transfer is credited exactly once; a block rollback rolls back the status too.
Signed requests and webhooks
API requests use HMAC-SHA256 with a timestamp and single-use nonce. Webhooks are signed with an HMAC of the raw body, with zero-downtime secret rotation.
Five rules for a secure integration
Most merchant incidents aren't blockchain hacks. They come from trusting the wrong signal.
- Keep the API secret on the serverNot in the browser, not in a mobile app, not in git.
- Fulfill based on the API status
paidoroverpaidfromGET /v1/invoices/{id}, notreturn_urlparameters or the webhook body. - Verify webhook signatures against the raw bodyAnd reject requests older than 5 minutes.
- Make fulfillment idempotentA webhook can arrive more than once: store the
X-Webhook-Idvalues you've processed. - Reject
livemode: falsein productionThat way, a sandbox connected by mistake can't ship goods.
A checkout page with no surprises
No third-party scripts
No analytics, no external fonts, no CDN. A strict Content-Security-Policy, and the QR code is drawn on the page.
Token after the “#”
The payment link carries its token in the URL fragment, so it never ends up in server logs or the Referer header.
No stale amounts
When the rate lock expires, the address and amount are hidden, so the customer can't pay at an outdated quote.