0xConnect

Security

Payaion is designed with security and privacy in mind. Here's how we protect your files and data.

How links are protected

  • Unique IDs — Each upload gets a randomly generated ID that's hard to guess
  • Automatic expiration — When an upload's retention window ends the link stops working and we remove our record; the stored blob is unreadable without its key. Guest uploads last a day by default, or 12 hours to 14 days on request; accounts keep files longer (see Limits & Quotas)
  • End-to-end encryption — A Private Link file is encrypted in your browser with a key that exists only in the link. We store ciphertext we cannot read and never receive the key, so there is nothing for us to hand over. The link is the key: whoever has all of it can open the file — so for sensitive files add a password (mixed into the file key, so the file cannot be opened without it) or send the key separately from the link
  • Manual deletion — With a dashboard account, you can delete uploads immediately
  • Not discoverable — Uploads are reachable only via their direct link. Nothing appears on the marketplace unless you list it there yourself
  • Decentralized storage — Files stored on Walrus network, not a single server

How API keys are protected

  • Shown once — Keys are displayed only during creation; we can't recover them later
  • Stored securely — Keys are hashed before storage; plaintext never saved
  • Tied to your wallet — Each key is linked to your authenticated wallet address
  • Revocable — Disable keys instantly from the dashboard
  • Rate limited — Automatic throttling prevents abuse

Best practices

  • Don't share links publicly — Anyone with the link can download the file
  • Keep API keys secret — Never commit them to git or expose them in client‐side code
  • Use environment variables — Store keys in .env files (never commit these)
  • Rotate compromised keys — If a key is exposed, revoke it and create a new one
  • Delete sensitive uploads — Remove files from the dashboard when you're done

Wallet authentication

Signing in means signing a message, not sending a transaction: it proves you own the address, costs no gas, and never exposes your private keys. Payaion stores no passwords and holds no custody of your wallet. The mechanics are in Wallets & sign-in.