# Control access to merchant and administrator payment records

> A payment dashboard needs authorization on the server, not only hidden menu buttons. Coinvay separates merchant-owned records from administrative operations, and application access should stay limited to the account and role that actually need it.

Publisher: Coinvay | Published: 2026-10-27 | Updated: 2026-10-27 | Category: Security
Canonical: https://coinvay.com/articles/merchant-account-access-control

Enforce merchant ownership and administrator roles on the server rather than relying on hidden menus or guessed record IDs.

## Distinguish public checkout from private operations

A buyer can open an invoice’s public checkout link without receiving the merchant’s dashboard permissions. Private invoice lookup, API-key management and account settings have different authentication requirements. For example, sharing a payment link with a customer should not expose the merchant’s other invoices, credentials or administrative functions. Do not reuse dashboard cookies as a server integration method or place privileged tokens into the shared checkout URL.


## Review every access path

API calls must enforce ownership even when someone guesses or modifies a record ID. The browser’s current page name is not a role assignment, and hiding an administrator sign-in link does not replace authorization. An ordinary merchant integration key should have only its documented merchant behavior; Coinvay requires interactive sign-in to create replacement API keys. Administrative actions belong to administrator sessions with the required account confirmation, not to a conveniently named frontend route.


## Operate account changes deliberately

For a business with separate developer and finance operators, document who owns the merchant account, who manages the receiving wallet and who can administer the service. Review connected login methods and revoke unused integration keys. Suspending a merchant account changes application access; it does not give the administrator custody over the merchant’s private wallet. Keep audit evidence of important changes and verify that a role or status update produces the intended access result. Avoid granting broad administrator access merely to solve a temporary support issue.


## Practical checklist

- Require server-side ownership and role checks for every private record operation.
- Keep public checkout capabilities separate from merchant and administrator credentials.
- Review account status, connected login providers and unused keys as personnel or systems change.

## Questions and answers

### Does hiding an administrator button secure the admin API?

No. Visibility is a user-interface choice. Server authorization must still reject unauthorized requests.

### Does administrator access mean control over merchant wallet funds?

No. Direct-wallet funds remain controlled by the wallet keys. Dashboard administration and on-chain signing authority are different responsibilities.

## Sources and further reading

- [Coinvay merchant API documentation](https://coinvay.com/docs)
- [OWASP authorization design guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html)

## Related guides

- [Protect the wallet keys that receive merchant payments](https://coinvay.com/articles/protect-merchant-wallet-keys)
- [Use Google Authenticator to protect a merchant account](https://coinvay.com/articles/google-authenticator-for-merchants)
- [Reduce phishing risk in crypto payment checkout](https://coinvay.com/articles/crypto-payment-phishing-prevention)

Published by Coinvay with AI-assisted drafting. Product claims were checked against the implementation and linked primary sources. Provider facts and pricing can change; verify the current terms before choosing a service. Examples are illustrative, not customer results. No ranking or AI citation is guaranteed.