This release adds headless API access, exact settlement tracking, QR codes for deposit payments, and a round of security hardening.
Breaking: API path renamed
All merchant dashboard endpoints have moved from /api/dashboard/* to /api/merchant/*. The old paths no longer work. Update your integrations accordingly.
Master API key
Merchants can now generate a master API key (msk_ prefix) from Dashboard → Settings. This key authenticates against all /api/merchant/* endpoints (create payments, list channels, manage settlement) without a browser session. Useful for backend services, scripts, and CI pipelines.
Master key management (generate, rotate, revoke) requires a browser login. A master key cannot rotate or revoke itself.
Settlement amount in webhooks
Webhook payloads now include dest_amount and dest_decimals: the exact number of tokens that landed in your wallet. This is critical for non-stablecoin settlements (e.g. TON) where amount_usd doesn’t tell you the token count. Divide dest_amount by 10^dest_decimals for the human-readable figure.
QR codes on deposit payments
Customers paying via deposit (Rubic cross-chain routes, TON, Tron) now see a scannable QR code above the copy fields. Chain-aware URIs: EIP-681 for native EVM, ton://transfer with memo for TON, Solana Pay with SPL token + memo, BIP-21 for BTC.
Channel edit page
Each channel now has a dedicated edit page at /dashboard/channels/:id with sections for branding, webhook URL, settlement override, API key rotation, and a danger zone for revoking access.
Pay Me Page channel
Setting up a Pay Me page now automatically creates a dedicated channel for it. This gives your Pay Me page its own branding, settlement destination, and webhook URL (independent of your other channels).
Webhook reliability
A new catch-all cron task fires webhooks for any payment that completed via inline status polling but whose webhook was silently skipped. No more missed notifications.
Security
- Rate limiting on admin login (5 attempts / 15 min per IP)
- CORS restricted to mutopay.com + localhost
- Content-Security-Policy header on all pages
- AES-256-GCM encryption for stored API keys
- Open redirect protection on return URLs