Crypto Merchant Account Security with 2FA and Trusted Addresses
Protect your crypto merchant account with 2FA, trusted withdrawal addresses and least-privilege API keys. A practical security checklist for sellers.
Crypto merchant account security matters from day one, because blockchain transfers can't be reversed. Once USDT or TRX leaves your balance and confirms on-chain, nobody can pull it back. The only real defense is to stop an attacker from starting a withdrawal in the first place. This guide covers the layers that do that: two-factor authentication, trusted withdrawal addresses and sensible API key management.
Why crypto merchant account security is different
With a bank you can sometimes dispute a fraudulent transfer. Crypto has no chargeback button. A TRON transaction is final once it's confirmed. We explain what that means in what are block confirmations. Your security model has to prevent problems, not clean them up afterwards.
The typical threats to a merchant account are:
- Password reuse: a password leaked from another site gets tried on yours.
- Phishing: a fake login page harvests your credentials.
- API key leaks: a key ends up in a public repo or in front-end code.
- Address manipulation: your payout address is swapped for a look-alike. See address poisoning attacks.
MercanPay puts a separate barrier in front of each of these.
Layer 1: Two-step login
Signing in to the MercanPay panel takes two steps. After your password you confirm with either an email code or a one-time code from an authenticator app (TOTP).
Prefer the authenticator app where you can. An email code is a solid second factor, but it's only as strong as your inbox. An authenticator code lives on your phone alone.
Practical tips:
- Turn on 2FA for your email account too. Your payment panel is only as safe as the inbox behind it.
- Set up your authenticator's backup and recovery options before you need them.
- Use a unique password for this account and keep it in a password manager.
Layer 2: Two codes for every withdrawal
By default, every withdrawal made from the panel needs both an email code and an authenticator (TOTP) code. Even if someone gets your password and manages to sign in, they still need your phone and your inbox at the same moment to move funds.
The one exception is a setting you turn on yourself: an address that has been saved for at least 7 days and has received at least 3 completed withdrawals can be marked as a code-free ("trusted") address, confirmed with your password, an email code and an authenticator code. Only withdrawals to that address skip the codes, and the trust is revoked automatically after a password reset or when the authenticator is removed.
It can feel like a lot of friction at first. But withdrawals are what an attacker is really after. Creating invoices or reading reports can't drain your balance, and a withdrawal can. So the strictest check sits right there.
Layer 3: Saved and trusted withdrawal addresses
You can keep your payout destinations as saved addresses in the panel. You no longer copy and paste a 34-character TRON address each time, and there is less room for a clipboard swap.
One step further are trusted addresses, which are enabled for code-free withdrawals. An address can be marked trusted when:
- it is at least 7 days old and has received 3 completed withdrawals, or
- your early-unlock request has been approved.
Marking it trusted requires your password, an email code and an authenticator code.
Why the distinction matters: API withdrawals can only go to trusted addresses. API payouts don't ask for confirmation codes, so the system makes sure that even a leaked key can only send money to addresses you verified earlier. Anything else is refused with address_not_trusted.
Layer 4: API key hygiene
API keys are how your site talks to MercanPay. Each key only does what its scopes allow:
| Scope | Grants | Give it to |
|---|---|---|
read |
Status, rates, supported coins, chain lookups | Monitoring and reporting tools |
invoices |
Create, read and list invoices | Your store's checkout |
withdrawals |
Payouts from your balance | Only systems that really send payouts |
The rule is least privilege. A store only needs invoices to take payments. Keep withdrawals on a separate key used by whatever actually automates payouts.
Key hygiene checklist:
- Never put a key in browser code, a mobile app or a public repository.
- Keep it in a server-side environment variable such as
MERCANPAY_API_KEY. - Use separate keys for separate systems, so a leak means revoking one key, not all of them.
- Revoke a key you suspect has leaked right away on the API Keys page.
- Treat the webhook signing secret (
whsec_…) the same way. We cover verification in how to verify a webhook signature.
# keep .env out of version control
MERCANPAY_API_KEY=mp_...
MERCANPAY_WEBHOOK_SECRET=whsec_...
Layer 5: The 24-hour withdrawal lock
After you reset your password or turn off two-factor authentication, withdrawals are blocked for 24 hours. The API returns withdrawals_locked during that window.
This is a key barrier against account takeover. Even if an attacker manages a reset, they can't drain the balance straight away, and the security email gives you time to notice and react. If the reset was yours, you only need to wait.
Layer 6: Activity log and security emails
The panel keeps an activity log of important account events, and you receive security emails when something sensitive happens.
Don't ignore them. If you see a sign-in or a change you don't recognize:
- Change your password immediately.
- Review your API keys and revoke anything suspicious.
- Check your saved address list.
- Contact us through the support ticket system in the panel.
A quick weekly look at the activity log is a healthy habit.
Operational habits that help
Settings are only half the story. A few habits make a big difference:
- Check the whole address, not just the first and last few characters.
- Send a small test first when paying out to a new address. The minimum withdrawal is 10 USD worth.
- Keep your device clean and your browser up to date.
- Use a bookmark to open the panel, not search results or links in emails. It's a simple, effective anti-phishing measure.
FAQ
Is an email code or an authenticator safer?
Both add a second factor. An authenticator code is generated only on your device, so it doesn't depend on your email account staying secure. Use it where you can.
Why can't I withdraw to any address through the API?
API withdrawals skip confirmation codes, so they are limited to saved addresses marked as trusted. That way a leaked key can't send funds somewhere unknown.
I reset my password. Why are withdrawals blocked?
A 24-hour security lock applies after a password reset or after turning off 2FA. Withdrawals reopen automatically when it ends.
What should I do if my API key leaks?
Revoke it on the API Keys page, create a new key, deploy it to your server and review the activity log.
Get started with MercanPay
To accept USDT and TRX on infrastructure built with security in mind, apply for a merchant account. For integration details, see the documentation. For the overall flow, read how to accept USDT TRC20 payments.
