Console Security
Passkeys, step-up authentication, bank-style session timeouts, and staff access controls for the merchant console.
Two-factor and passkeys#
- Two-factor authentication is available from Account settings - turn it on and logins require your second factor
- Passkeys (WebAuthn) are built into the platform - enrollment, passwordless sign-in, and step-up ceremonies - and are rolling out to the console UI; until then, use email + password with 2FA
- Passkeys are phishing-resistant by design: bound to
pay.u.cash, verified by your device, and nothing reusable is ever transmitted
Sessions#
- Idle timeout: 30 minutes of inactivity ends the session - a countdown warning appears 5 minutes before, bank-style
- Absolute limit: 12 hours per login, no matter the activity
- An expired session stays signed out - re-authenticate; there is no silent resurrection
- Single logout: signing out of U.CASH signs you out across the U.CASH app family on that device
- Login alerts: get an email for each new login (URL, time, IP) when enabled in notifications
Staff access#
Every console action is gated by a permission, and staff accounts carry a role that expands to a permission set - from read-only auditors to full admins. Wallet and processor settings additionally require their specific permissions, and removing linked wallets skips nothing without authorization. See Roles & Permissions for the role ladder.
Platform hardening#
- Content Security Policy with Trusted Types enforced on every page - a big class of XSS dies at the sink
- HSTS, nosniff, and strict referrer policy on all surfaces
- Uploaded and legacy HTML served in a strict sandbox, isolated from sessions
- Webhook egress restricted to public HTTPS hosts (SSRF guard)
- Per-tenant encrypted secrets: processor keys, node macaroons, and exchange keys are encrypted at rest with a per-account key
More on the platform posture at Security.