Inside the file
Merchant console
Once the USAePay login succeeds, the left rail is dull on purpose: batches, recurring, users, statements. The dangerous items sit two clicks further — bank accounts and vault wipe.
Users worth creating on day one
- Floor: keyed sale only.
- Bookkeeper: statements and deposits, no vault edit.
- Owner: banks, users, API keys.
If one laptop is shared, do not share one owner login. The audit trail is the only record when a refund looks wrong three weeks later.
API keys are not a second login
Developers will ask for “the USAePay login” and mean the source key. Keep that string out of the UI password box. Rotate it from the owner user, not from a ticket forwarded to Slack.