What a private key is
Public-key cryptography uses a matched pair of keys. The private key is a secret value — in practice a very large random number — and the public key is derived from it, with the address you receive funds at derived from the public key in turn. The derivation runs one way only: you can compute the public key and address from the private key, but you cannot work backward from an address to the key that controls it. That asymmetry is what lets an address be shared freely while the key behind it stays secret.
Spending is a signature. To move funds out of an address, you build a transaction and sign it with the private key. The signature proves to every node on the network that the holder of the key authorized the transaction, without ever revealing the key itself. Nodes verify the signature against the public key and the funds move — no part of the network checks an identity or a permission list, so a valid signature is the only authorization there is.
This is why self-custody is unforgiving. Control of an address is exactly control of its private key. A leaked key lets anyone who has it sign and drain the address before you can react; a lost key strands the funds permanently, because no one can produce the signature the network requires. No central party can reverse a theft, freeze an address, or restore access — the key is the authority, so protecting it is the whole job.
Why it matters for crypto payments
A payment system holds private keys for the addresses it receives at and pays out from, and those keys are the entire attack surface for the funds. Receiving needs no key — anyone can pay into an address — but sending requires a signature, so every payout, sweep, and settlement traces back to a key that must be available to sign yet kept out of an attacker's reach. The security of the funds reduces to the security of those keys and the process that decides when they may sign.
Because a private key cannot be reset or recovered, the defences around it are operational rather than corrective: keys that must sign automatically are kept apart from the bulk of funds, a request to move money is approved before a signature is produced, the credential that can trigger a signature is scoped to only the actions it is granted, and every signing event is recorded so money movement can be reviewed rather than trusted.
Keys and signing on halfin
halfin signs on a merchant's behalf, so the guarantees on offer are about how keys are used rather than a broader custody promise. The blockchain private keys that sign transactions stay inside halfin, and the controls are concrete: a payout is signed only after it is approved, API keys carry scoped permissions so a credential can authorize only the actions it is granted, and signing events are auditable so money movement can be reviewed after the fact. halfin does not advertise custody assurances beyond signing, permissions, and audit.
For a merchant, the practical surface is the API key, not the blockchain key. The API key authorizes calls against the merchant's account, and it deserves the same discipline as any secret that can move value: store it server-side, never ship it to a browser or a customer's device, scope it to the permissions the integration actually needs, and rotate it if it is ever exposed. A leaked API key is the closest thing in the integration to a leaked signing key.
Signed messages run the other way too. The webhooks halfin sends are HMAC-signed, so an integration can confirm a notification genuinely came from halfin before acting on it. As with every signed message in the platform, verify first: treat the signature, not the payload's appearance, as the source of truth.
- A private key is the secret that authorizes spending; the public key and address derive from it, never the reverse.
- Moving funds means signing a transaction with the key — a valid signature is the only authorization the network checks.
- Keys cannot be reset or recovered: a leaked key drains an address, a lost key strands the funds, with no central party to undo either.
- On halfin, blockchain keys stay internal and money movement is approval-gated, permission-scoped, and auditable; the merchant's job is to guard the API key like a secret that can move value.