Build & launch
Security
Who can do what, how keys and payout wallets are protected, and how every sensitive change is recorded.
Team roles
| Action | Member | Admin | API key |
|---|---|---|---|
| View invoices, webhooks, keys, events, wallets | Yes | Yes | With read permissions |
| Create or revoke API keys | No | Yes | Never |
| Create or change webhook endpoints | No | Yes | With write:webhooks |
| Change payout wallets | No | Yes, with emailed code and hold | Never |
| Pin the API version | No | Yes | Never |
| Audit log, Needs review, email delivery | No | Yes | Never |
| Create invoices, record refunds | No | Yes | With write:invoices |
Roles come from your organization in the BOSPay console (admin or member). Every console request is checked on the server: you must be a registered member of a registered, active organization. A suspended organization cannot sign in and its API keys stop working.
Keys
- Secret and restricted keys stay on your backend. Browsers and apps get a publishable key or a checkout session token only.
- Use restricted keys with the fewest permissions in production.
- API keys cannot create, rotate or revoke API keys; only admins in the console can.
- Keys are stored as SHA-256 digests and shown once. Revocation takes effect within 15 seconds.
- Never put a key in a URL, including WebSocket URLs; use realtime tokens.
Payout wallets
Only console admins can change payout wallets, with an emailed code and a 24-hour hold during which everyone is notified and any admin can cancel. API keys can never change wallets, and invoices can only settle to registered wallets.
Audit log
Console → Security keeps who did what and when: API keys created, updated, rotated or revoked; webhook endpoints created, changed, deleted or re-keyed; payout wallet requests, confirmations, cancellations and removals; refunds recorded; review decisions. Entries record the user or API key, the request id and IP address.
Needs review
When a request fails without a definite result and repeating it could create a duplicate, BOSPay does not re-run it on its own. It is listed under Security → Needs review with the error and request id. An admin checks what happened and either releases the Idempotency-Key for a retry or marks the operation completed. Interrupted invoices are finished automatically with their original quote, and can be retried from the same screen.
Email delivery
Wallet confirmation codes, wallet change notices and webhook failure alerts are emailed. Security → Email delivery shows every email we sent your organization with its status (sent, failed with the reason, or skipped), and lets admins send themselves a test. Confirmation codes are never stored. Team invitations are sent by the sign-in provider.
Callbacks
- Signed raw-body verification, a five-minute timestamp window, and deduplication on event id.
- Webhook URLs must be public https. The address is checked when you save the URL and again on every delivery, so a DNS change cannot point deliveries at a private network.
- Deliveries do not follow redirects, time out after 10 seconds, and read at most 16 KB of your response.