# BTCPay Server Merges Fix That Keeps Store API Keys Within Scope

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/41123
Published: 2026-10-26T16:15:44.000Z
Updated: 2026-10-26T16:15:44.000Z
Section: Technology

> As of Oct. 27, the latest listed release was version 2.4.5, released before the fix was merged.

Nicolas Dorier merged a BTCPay Server change into the project’s master branch on Oct. 19 to keep API keys limited to one store within the permissions granted to them. The change blocks those keys from using server-wide or account-wide permissions solely because their owner is a server administrator.

The fix also prevents a restricted key from creating a broader API key for another user. Three integration tests cover server-role access, user-account deletion and an attempt to create an unrestricted key without a store scope.

BTCPay’s Greenfield API is used by integrations. Its API keys can be limited by the actions they can perform and by the stores they can access. The change addresses the combination of broad permissions and a store-specific scope; it does not establish that an invoice-only key could gain administrator powers.

The fix had not reached the latest listed release as of Oct. 27. Version 2.4.5, released Oct. 6, came 13 days before the merge. In v2.4.5, the authorization handler could match any scope when no scope was resolved for a request; the API-key controller also lacked the caller-grant check introduced by the patch.

“API keys now stay within the authority they were granted,” Kukks said. The change is in master; version 2.4.5 remained the latest listed release as of Oct. 27.