{"id":14938,"date":"2026-10-26T13:54:48","date_gmt":"2026-10-26T13:54:48","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14938"},"modified":"2026-10-26T13:54:48","modified_gmt":"2026-10-26T13:54:48","slug":"btcpays-api-key-fix-is-merged-but-its-latest-release-still-predates-the-patch","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14938","title":{"rendered":"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>BTCPay Server, software for accepting Bitcoin payments, merged a fix on Oct. 19 for a gap that could let API keys with broad permissions for one store reach server-wide or account-wide functions. For merchants sharing such credentials with an integration, the risk is delegating more authority than intended.<\/p>\n<p>Nicolas Dorier merged PR #7684 into the project&#8217;s master development branch. As of Oct. 26, BTCPay&#8217;s release list still identifies version 2.4.5, dated Oct. 6, as its latest release.<\/p>\n<h2>How the permission boundary changes<\/h2>\n<p>BTCPay&#8217;s authentication documentation describes API keys as integration credentials restricted by permission and store. Those are separate limits: what an application may do, and which store it may act on.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The added regression tests use keys with unrestricted permissions scoped to a single store: broad authority over actions, with a separate limit on where they apply. One asserts that an administrator-owned key must be denied access to server roles. Another asserts that an ordinary user&#8217;s key must be denied deletion of that user&#8217;s account.<\/p>\n<p>These examples involve broad store-scoped grants. They do not establish that an invoice-only key can obtain administrator powers. Server-level access also depends on the owner&#8217;s administrator role.<\/p>\n<p>The authorization change narrows a fallback used when a request has no resolved scope: accepting a grant from any store is now allowed only for store permissions. That fallback no longer satisfies server-wide or account-wide checks. According to the PR description, existing unscoped administrator keys retain their behavior.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter cs-newsletter-brand\" data-newsletter-edition=\"catalyst\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\">\n<div class=\"cs-inline-newsletter__editorial\">\n<p class=\"cs-inline-newsletter__eyebrow\">The Catalyst<\/p>\n<p class=\"cs-newsletter-frequency\">Daily Newsletter<\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">Know what\u2019s moving crypto.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start with the stories that matter. Get the context behind the headlines and a clear view of what to watch next.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__art\" aria-hidden=\"true\"> <img loading=\"lazy\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<\/div>\n<\/div>\n<\/aside>\n<p><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter shoggoth-infographic shoggoth-infographic-portrait wp-image-576708\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c.png\" alt=\"BTCPay API permission and store-scope comparison, key-creation prerequisites, and the October 6 release, October 19 merge and October 25 release-status check.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c-768x960.png 768w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\"\/><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"lazyload aligncenter shoggoth-infographic shoggoth-infographic-portrait wp-image-576708\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c.png\" alt=\"BTCPay API permission and store-scope comparison, key-creation prerequisites, and the October 6 release, October 19 merge and October 25 release-status check.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d6ae6566-7547-4dae-aac0-4f2fc82a6b1c-768x960.png 768w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><\/p>\n<p>To prevent an authorized key-creation call from producing a more powerful credential, the patch also checks requested permissions against the caller&#8217;s grants. An added test asserts rejection when an administrator&#8217;s key limited to server-settings authority requests an unrestricted, unscoped key.<\/p>\n<p>Key creation still has separate entry requirements. The self-service endpoint requires unrestricted authority without a store scope; the administrator&#8217;s user-targeted endpoint requires server-settings modification authority. The controller change adds a check on what the caller may grant after those requirements are met.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The public PR does not report confirmed exploitation, affected merchants or losses.<\/p>\n<p>Version 2.4.5&#8217;s tagged authorization handler and key controller retain the earlier checks changed by this PR. The first affected version remains unclear.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">BTCPay Docker users must opt into Tor at their next update to keep onion access<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>BTCPay&#8217;s documentation recommends requesting the narrowest useful permissions. Merchants can review delegated keys for broad grants and their owners&#8217; privileges, then narrow permissions to what each integration needs. The next concrete remediation milestone is a published release containing PR #7684, followed by confirmation that the deployed build includes it.<\/p>\n<\/div>\n<p>Featured,Payments,Technology,Bitcoin,BTC,paymentsBitcoin,BTC,payments#BTCPays #API #key #fix #merged #latest #release #predates #patch1793022888<\/p>\n","protected":false},"excerpt":{"rendered":"<p>BTCPay Server, software for accepting Bitcoin payments, merged a fix on Oct. 19 for a gap that could let API keys with broad permissions for one store reach server-wide or account-wide functions. For merchants sharing such credentials with an integration, the risk is delegating more authority than intended. Nicolas Dorier merged PR #7684 into the<\/p>\n","protected":false},"author":1,"featured_media":14939,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[6537,91,285,7590,1053,1562,1241,7591,6427,167,7592,4020],"class_list":["post-14938","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-api","tag-bitcoin","tag-btc","tag-btcpays","tag-fix","tag-key","tag-latest","tag-merged","tag-patch","tag-payments","tag-predates","tag-release"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>BTCPay\u2019s API key fix is merged, but its latest release still predates the patch - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"BTCPay&#039;s October 19 API-key scope fix limits delegated authority, but version 2.4.5 still predates the change and remains the latest listed release.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=14938\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch\" \/>\n<meta property=\"og:description\" content=\"BTCPay&#039;s October 19 API-key scope fix limits delegated authority, but version 2.4.5 still predates the change and remains the latest listed release.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=14938\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-26T13:54:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14938\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=14938\",\"name\":\"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14938#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14938#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp\",\"datePublished\":\"2026-10-26T13:54:48+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"BTCPay&#039;s October 19 API-key scope fix limits delegated authority, but version 2.4.5 still predates the change and remains the latest listed release.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14938#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=14938\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14938#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14938#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch - Crypto News: Latest Cryptocurrency News and Analysis","description":"BTCPay&#039;s October 19 API-key scope fix limits delegated authority, but version 2.4.5 still predates the change and remains the latest listed release.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=14938","og_locale":"en_US","og_type":"article","og_title":"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch","og_description":"BTCPay&#039;s October 19 API-key scope fix limits delegated authority, but version 2.4.5 still predates the change and remains the latest listed release.","og_url":"https:\/\/cryptonews.uk.com\/?p=14938","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-10-26T13:54:48+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=14938","url":"https:\/\/cryptonews.uk.com\/?p=14938","name":"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=14938#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=14938#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp","datePublished":"2026-10-26T13:54:48+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"BTCPay&#039;s October 19 API-key scope fix limits delegated authority, but version 2.4.5 still predates the change and remains the latest listed release.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=14938#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=14938"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=14938#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/btcpay-api-credential-scope.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=14938#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"BTCPay\u2019s API key fix is merged, but its latest release still predates the patch"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14938"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14938\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/14939"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}