Security and Access

Stash Cloud uses least privilege and node-level isolation. Third-party developers use API Keys for the public Cloud management API; this does not grant access to native node interfaces or arbitrary users' nodes.

API Key safety

Use Authorization: Bearer <API_KEY> with management API /v3, with scopes nodes:read / nodes:write; deletion also requires nodes:write. See authentication.

• API Keys are programmatic credentials, not mnemonics or node private keys. Store them only on controlled servers, never in web pages, mobile apps or public repositories.
• If a key leaks, revoke and replace it immediately through the official product workflow. Do not record full keys in logs, monitoring or error reports.
• Requests can operate only on nodes belonging to the current tenant. Use the correct network and minimum required scopes; do not attempt to access other tenants' resources.
• API Keys cannot call native channel, payment, RGB or swap interfaces. Domains and addresses in node details are not access authorization; see runtime scope.

Node and data isolation

Each node has independent compute, persistent storage and network boundaries. Nodes do not share data storage; isolation also applies between nodes owned by the same tenant. Resource usage is subject to effective account and network quotas; do not assume fixed defaults.

Isolation reduces cross-node access risks but does not replace application authorization, credential protection or verifiable backups.

Funds and recovery safety

• Creating a node by name produces a new funds identity; it cannot restore an old node or the funds and channel state associated with an old mnemonic.
• Do not resolve migration issues by deleting or recreating nodes. First confirm recoverable backups and migration procedures through the official product workflow.
• A mnemonic does not contain all channel state or RGB validation data. Do not assume the blockchain can reconstruct all local state.
• Only one node may be online with the same channel state. Stop the original node before starting a restored copy to avoid channel penalty risks.
• Never publicly share mnemonics, backup archives or API Keys; verify backup integrity before recovery.

Further reading: node management, backup storage.