veil

For AI Agents

x402-ready identities for autonomous payments

For Teams

Crypto payroll to any bank globally — coming soon

For Everyone

Send and receive by tag, bank stays private

DocsSecurityBlogAbout
Get started

Secure by architecture.

Even a compromised API key can’t steal your funds. Here’s why.

One direction. No reverse path.

One-way by design

Veil is a one-way offramp. Funds flow in one direction: from a crypto wallet, through a licensed conversion partner, to a bank account. There is no reverse path.

There is no function in the API to send crypto to an external wallet, and no way to change a payout destination mid-transaction. Payouts land in a KYC-verified Veil bank account - your own, or another Veil user’s via their @username. And every payout to someone else requires a fresh email OTP, so a stolen API key alone can only ever move money to your own bank.

If someone gains access to your API key, the worst they can do is trigger an offramp to your own bank account. They can’t send anywhere else - third-party payouts always need a fresh email code. Your money still arrives at your bank. Not theirs.

What an attacker cannot do

Send funds to anyone else - paying a @username always requires a fresh email OTP an attacker can't receive
Send crypto to an external wallet - the API has no outbound transfer function
Change your payout bank without an email OTP - bank changes need a fresh code and trigger a 48-hour hold
Bypass identity verification - every account is verified through a licensed KYC provider
Access the dashboard with just an API key - the dashboard requires a separate email login

What an attacker can do

With a compromised API key.

With a stolen API key, an attacker can trigger an offramp to your own verified bank account, and read wallet balances and transaction history. They cannot send to anyone else - every third-party (@username) payout requires a fresh email OTP they can’t receive.

This is the blast radius. It’s limited by design.

To limit exposure further: rotate your API key immediately from the dashboard, enable IP allowlisting for production keys, and keep the email OTP confirmation on for your own bank account.

How your account is protected

Defense in depth.

01Secure credential storageThe Veil CLI stores your API key in your operating system’s keychain - macOS Keychain, Windows Credential Manager, or Linux Secret Service. Encrypted at rest, protected by your OS login. Never stored in plain text.
02Identity verificationEvery account is verified through a licensed third-party KYC provider before any live offramp is allowed. Your payout bank account must match your verified identity.
03Email OTP step-upA one-time code sent to your email is required before enabling live mode, for any payout to another user’s @username, and for changing your payout bank account. A stolen API key alone can never satisfy it.
04Bank-change protectionYour payout bank is tied to your KYC identity. Adding or changing one requires an email OTP and starts a 48-hour security hold before it can receive funds. You receive an email notification immediately when a change is requested.
05API key controlsCreate scoped keys: read-only for monitoring, full-access for operations. Rotate or revoke keys instantly from the dashboard. Optionally restrict keys to specific IP addresses.
06Email notificationsEvery offramp triggers an email notification - manual or automated. Bank account change requests, API key creation, rule changes, and login from new devices all trigger immediate alerts.
07Account freezeInstantly freeze all offramp activity with one click or one CLI command. No code required to freeze - speed matters in an emergency. An email OTP is required to unfreeze.
08No custodyVeil never holds, stores, or has access to your crypto or fiat at any point. Funds are received and converted by a licensed payment partner. We orchestrate the flow - we never touch the money.

Security for automated offramps

Manual offramps

Triggered from dashboard or CLI

Email OTP required to release funds

Human is present to authenticate

Automated offramps

Triggered by an auto-settle source address

Email OTP required when you turn it on

Converts deposits hands-free to your bank

This is the same model as standing orders in traditional banking - you authenticate once to set up the instruction, then it executes automatically.

If something goes wrong

If you suspect unauthorized access:

01Freeze your account immediately - dashboard or veil account freeze from any terminal
02Revoke all API keys from the dashboard
03Contact security@useveil.co

Freezing is instant and requires no code. All pending offramps are paused. No funds leave your account while frozen.

Questions about security?

Reach us at security@useveil.co

Get started →