In a direct-wallet gateway, the merchant controls the keys that control received funds. Coinvay checkout and transaction verification do not require your seed phrase or private key, so a request for either should stop the setup process.
Keep receiving information separate from signing secrets
A receiving address is intended to be shared with customers. A private key or recovery phrase is not a setup field for accepting payments. Wallet-linking signatures can prove control of an address without exporting its private key, but the message still deserves careful review. For example, linking a checkout wallet should not require approving an unrelated token spender or sending funds to a support address.
Design for the business using the wallet
Choose wallet access and backup arrangements that match who is authorized to move business funds. A hardware signing device or a multi-person approval arrangement may be appropriate, but test the exact wallet’s compatibility and recovery process rather than assuming the device name guarantees safety. Keep a separate test wallet for experiments and avoid storing recovery material in a shared team chat, browser notes or screenshots of a QR enrollment screen.
Protect the account that can change the destination
A secure signing wallet does not prevent an attacker from trying to replace the payment gateway’s receiving address. Protect the Coinvay account, its email account, connected identity providers and administrator access. After changing a receiving address, inspect an actual checkout and verify the destination independently. Keep operational access limited to the people who need it and maintain a documented response for suspected compromise. No gateway can promise that careful key handling eliminates every attack or user error.
Practical checklist
- Never enter a seed phrase or private key into gateway forms or support messages.
- Test wallet recovery privately and protect backups from both loss and unauthorized access.
- Review gateway account security and verify checkout destinations after wallet changes.
Common questions
Does Coinvay need my private key to monitor payments?+
No. Public blockchain transaction data can be checked against a receiving address and quote without obtaining the key that signs transfers.
Is a public receiving address the same as a recovery phrase?+
No. An address identifies a destination. A recovery phrase can control wallets and must remain secret.
Sources and further reading
Primary references and Coinvay product documentation. Check the linked pages for current details.
AI-assisted drafting, published by Coinvay. Examples are illustrative. Read our editorial approach.