Security
Keep account access personal and verify payment instructions in the authenticated portal. Contact XDC Tech promptly if something looks unexpected.
Protect your sign-in
- Use a unique, strong password stored in a password manager.
- Keep your email account secure because the published sign-in flow uses emailed one-time codes.
- Never share passwords or one-time codes, including with someone claiming to be XDC Tech.
- Use individual accounts and limit access to people who need it.
Verify messages and payment details
The published guide identifies notifications@payments.xdc.tech as the portal notification sender. A familiar sender name alone is not proof that a message is genuine. Confirm unexpected requests through your named XDC Tech contact.
Treat payment instructions received by email, phone or chat as unverified until you have checked them inside the portal. Confirm current deposit, recipient and wallet details before use.
Protect API credentials
Keep API keys in your organization's secrets manager and make them available only to the backend service that needs them. Keep secrets out of browser code, source control, logs, shared Postman workspaces and support messages.
Authorized business API-key administrators create and revoke keys in the portal. Select only the permissions your integration needs, store the secret when it is shown, and revoke unused or compromised keys. See credentials and access for the current workflow.
Report a concern
Email support@xdc.tech or use your named onboarding contact. Describe the issue without including secrets, one-time codes or full account details.