Update POS callback authentication guidance (#7566)
What the developer wrote
Authored by Nicolas Dorier
Update POS callback authentication guidance (#7566)
What changed, and why it matters
This commit only updates user-facing help text in the Point of Sale plugin. It replaces outdated guidance about legacy API keys and Basic authentication with newer guidance about API tokens and the correct REST API endpoint. No code logic, authentication checks, or security behavior changed.
No security action needed. Treat as a normal documentation update.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies two strings in UpdatePointOfSale.cshtml and the matching translation entry in Translations.Default.cs. The old text told merchants to call /invoices/{invoiceId} using a legacy API key with Basic auth. The new text tells them to call /api/v1/invoices/{invoiceId} using an Authorization: token YOUR_API_KEY header and to create the key in Account settings with View invoices permission. This is a documentation/guidance-only change.
Changed components
BTCPayServer/Plugins/PointOfSale/Views/UpdatePointOfSale.cshtmlBTCPayServer/Plugins/Translations/Translations.Default.csInspect captured patch +2 / −2
### BTCPayServer/Plugins/PointOfSale/Views/UpdatePointOfSale.cshtml
@@ -337,7 +337,7 @@ Please insert valid HTML here. Only meta tags accepted.'>
<pre class="p-3">@Model.ExampleCallback</pre>
<p html-translate="true"><strong>Never</strong> trust anything but <code>id</code>, <strong>ignore</strong> the other fields completely, an attacker can spoof those, they are present only for backward compatibility reason:</p>
<ul>
- <li html-translate="true">Send a <code>GET</code> request to <code>https://btcpay.example.com/invoices/{invoiceId}</code> with <code>Content-Type: application/json; Authorization: Basic YourLegacyAPIkey"</code>, Legacy API key can be created with Access Tokens in Store settings</li>
+ <li html-translate="true">Send a <code>GET</code> request to <code>https://btcpay.example.com/api/v1/invoices/{invoiceId}</code> with <code>Authorization: token YOUR_API_KEY</code>. Create the API key in Account settings and grant it the View invoices permission for this store.</li>
<li html-translate="true">Verify that the <code>orderId</code> is from your backend, that the <code>price</code> is correct and that <code>status</code> is <code>settled</code></li>
<li text-translate="true">You can then ship your order</li>
</ul>
### BTCPayServer/Plugins/Translations/Translations.Default.cs
@@ -1629,7 +1629,7 @@ static Translations()
"selected": "",
"Send": "",
"Send {0}": "",
- "Send a <code>GET</code> request to <code>https://btcpay.example.com/invoices/{invoiceId}</code> with <code>Content-Type: application/json; Authorization: Basic YourLegacyAPIkey\"</code>, Legacy API key can be created with Access Tokens in Store settings": "",
+ "Send a <code>GET</code> request to <code>https://btcpay.example.com/api/v1/invoices/{invoiceId}</code> with <code>Authorization: token YOUR_API_KEY</code>. Create the API key in Account settings and grant it the View invoices permission for this store.": "",
"Send invitation email": "",
"Send me everything": "",
"Send requests": "",Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.