Security
Security is paramount when handling cryptocurrency payments. This section covers security best practices and guidelines for your BITXpay integration.
Topics
Authentication Security
Secure your API credentials and implement proper authentication.
Best Practices
General security recommendations for your integration.
Security Features
BITXpay provides several security features out of the box:
| Feature | Description |
|---|---|
| Ed25519 Request Signing | Every merchant API request is signed with your private key |
| TLS Encryption | All communications use TLS 1.3 |
| Webhook Signatures | Verify webhook authenticity (HMAC-SHA256) |
| Rate Limiting | Protection against abuse |
| IP Whitelisting | Optional IP-based access control (coming soon) |
| 2FA | Two-factor authentication for dashboard |
Security Compliance
BITXpay is compliant with:
- PCI DSS - Payment Card Industry Data Security Standard
- SOC 2 Type II - Service Organization Control
- GDPR - General Data Protection Regulation
Reporting Security Issues
If you discover a security vulnerability, please report it to:
- Email: security@bitxpay.com
- Bug Bounty: https://bitxpay.com/security/bug-bounty
WARNING
Never disclose security vulnerabilities publicly before they have been addressed.