# Protect the wallet keys that receive merchant payments

> In a direct-wallet gateway, the merchant controls the keys that control received funds. Coinvay checkout and transaction verification do not require your seed phrase or private key, so a request for either should stop the setup process.

Publisher: Coinvay | Published: 2026-10-27 | Updated: 2026-10-27 | Category: Security
Canonical: https://coinvay.com/articles/protect-merchant-wallet-keys

Protect merchant wallet recovery material, review signing requests and secure the account that controls checkout destinations.

## Keep receiving information separate from signing secrets

A receiving address is intended to be shared with customers. A private key or recovery phrase is not a setup field for accepting payments. Wallet-linking signatures can prove control of an address without exporting its private key, but the message still deserves careful review. For example, linking a checkout wallet should not require approving an unrelated token spender or sending funds to a support address.


## Design for the business using the wallet

Choose wallet access and backup arrangements that match who is authorized to move business funds. A hardware signing device or a multi-person approval arrangement may be appropriate, but test the exact wallet’s compatibility and recovery process rather than assuming the device name guarantees safety. Keep a separate test wallet for experiments and avoid storing recovery material in a shared team chat, browser notes or screenshots of a QR enrollment screen.


## Protect the account that can change the destination

A secure signing wallet does not prevent an attacker from trying to replace the payment gateway’s receiving address. Protect the Coinvay account, its email account, connected identity providers and administrator access. After changing a receiving address, inspect an actual checkout and verify the destination independently. Keep operational access limited to the people who need it and maintain a documented response for suspected compromise. No gateway can promise that careful key handling eliminates every attack or user error.


## Practical checklist

- Never enter a seed phrase or private key into gateway forms or support messages.
- Test wallet recovery privately and protect backups from both loss and unauthorized access.
- Review gateway account security and verify checkout destinations after wallet changes.

## Questions and answers

### Does Coinvay need my private key to monitor payments?

No. Public blockchain transaction data can be checked against a receiving address and quote without obtaining the key that signs transfers.

### Is a public receiving address the same as a recovery phrase?

No. An address identifies a destination. A recovery phrase can control wallets and must remain secret.

## Sources and further reading

- [Coinvay merchant API documentation](https://coinvay.com/docs)
- [Ethereum security and scam-prevention guidance](https://ethereum.org/security/)

## Related guides

- [Use Google Authenticator to protect a merchant account](https://coinvay.com/articles/google-authenticator-for-merchants)
- [Reduce phishing risk in crypto payment checkout](https://coinvay.com/articles/crypto-payment-phishing-prevention)
- [Verify blockchain payment evidence before fulfilling an order](https://coinvay.com/articles/verify-blockchain-transactions-safely)

Published by Coinvay with AI-assisted drafting. Product claims were checked against the implementation and linked primary sources. Provider facts and pricing can change; verify the current terms before choosing a service. Examples are illustrative, not customer results. No ranking or AI citation is guaranteed.