Access control
Access control ensures that only authorized users and systems can perform sensitive actions.
User roles
A member of an organisation has one of five roles: owner, admin, member,
viewer, or api_consumer (programmatic access only).
Roles decide what a signed-in person may do. Each role carries a set of
permissions that the API checks on the actions that matter: sending a payout
(payouts.create), executing a conversion (fx.execute), onboarding to
Collect (collect.manage), the other Collect writes (collect.links.create),
and managing API keys (api_keys.manage). An owner or admin holds all of
them; a member all but Collect onboarding and key management; a viewer or
api_consumer none. A refused action is 403 permission_denied. Billing
needs an owner or admin. A dashboard session moving money is also limited by
step-up.
Credentials and scopes
Every route an API key can call needs a scope, including the money API
(/v1/banking/*): a restricted key reaches exactly what its scopes open, a
secret key holds every scope, and a master key bypasses key checks. API keys
are not subject to roles, which is why a key is capped at its creator's seat
when it is minted: a viewer cannot mint a key that pays. Give each service its
own key with the narrowest scopes that do the job, so you can revoke one
without stopping the others, and do not use a master key for routine payouts.
See Authentication.
Approvals and separation of duties
CashXChain has no approval workflow: a payout is sent when it is submitted. If you need a second person to approve a payment, or a threshold above which one must, build it in your own system before the API call — and keep the ability to create a payment separate from the ability to approve it.
Session security
Every dashboard sign-in takes two factors, and every user sets up a passkey or an authenticator app during onboarding. A dashboard session must also step up — confirm with that passkey or authenticator — for every payout, and for conversions of 10,000 USD or more. API keys never step up.
Deprovisioning
Remove users and rotate credentials immediately when employees, contractors, or vendors no longer require access.