BTCPay Server, software for accepting Bitcoin payments, merged a fix on October 19 for a permission boundary gap that could allow API keys with broad permissions for one store to reach server-wide or account-wide functions. Merchants sharing such credentials with integrations risk delegating more authority than intended.
Nicolas Dorier merged pull request #7684 into the project's master development branch. As of October 26, version 2.4.5, dated October 6, remained BTCPay's latest listed release.
How the Permission Fix Works
BTCPay's API keys are restricted by two separate limits: what permissions an application may exercise, and which store it may act on. The merged fix narrows a fallback mechanism used when a request has no resolved scope. Under the new rules, accepting a grant from any store is now allowed only for store permissions. The fallback no longer satisfies server-wide or account-wide checks.
The patch adds checks to prevent key creation from producing more powerful credentials than the caller possesses. An administrator's key limited to server settings authority cannot request an unrestricted, unscoped key. According to the PR description, existing unscoped administrator keys retain their previous behavior.
Key creation endpoints maintain separate requirements. The self-service endpoint requires unrestricted authority without a store scope. The administrator's user-targeted endpoint requires server-settings modification authority.
Next Steps for Users
BTCPay's documentation recommends requesting the narrowest useful permissions for each integration. Merchants can review delegated keys for broad grants and review their owners' privileges, then narrow permissions as needed. The next remediation milestone is a published release containing PR #7684.
