Skip to content
EVENT / TOPICHistorical

BTCPay API key permission fix merged as patch goes live

1 reports1 sources10/26/2026 updated

Current overview (not historical)

AI overview

BTCPay merged PR #7684 to fix API key permission boundaries, preventing broad store permission keys from passing server or account access checks. Merged on October 19, the update adds regression tests requiring that administrator keys be denied server role access and standard user keys be denied account deletion. Authorization changes restrict fallback mechanisms: requests without a resolved scope may only accept store authorization for store permissions. As of October 26, version 2.4.5 retains the old permission checks; the fix will take effect in a future release containing the patch.

Written with AI from the reporting · updated 10/26/2026

Latest developmentOct 26, 21:00
BTCPay merges fix to restrict broad API key permissions
Explore the timeline, relations and evidence
Expand the detailed fact route and sources

Story route

A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.

  1. 1Unclassified fact stationOct 19, 00:00recorded Oct 26, 21:17single sourcerevised

    BTCPay API key permission fix merged

    Read original source ↗ CryptoSlateReplay this moment in the explorer
    Evidence & revisions · 1 source records
    Subject：
    btcpay
    Action：
    merged PR #7684 to restrict broad store-scoped API keys
    Object：
    API key permission checks
    Occurred (fact side)：
    Oct 19, 00:00
    CryptoSlate ↗Report pageRevision 3 · currently revised
    Published (valid side)：
    Oct 26, 21:00
    First seen (known side)：
    Oct 26, 21:17
    Fact stationSingle source · one-sided claimRevised

    Copy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.

Uncertainty marks flag where to check the sources; they are not proven causation.

Report timeline

Explore every side through dated source reports.

Oct 26
  1. CryptoSlateRelated fact: single sourceSource report revised
    BTCPay merges fix to restrict broad API key permissions

    Report first recorded Oct 26, 21:17

    BTCPay merged a fix on October 19 to restrict broad store-scoped API keys from accessing server-wide or account-wide functions. As of October 26, version 2.4.5 remains the latest release and still contains the earlier permission checks. The change narrows a fallback that previously allowed accepting grants from any store, now requiring store-specific permissions for server-level access.

    Read original source ↗

Event activity trend

Latest comparable
3
Comparable peak
3Oct 28, 14:00
24h change
–

The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.

Event discussion

Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.

Open GitHub Discussions