From f10a61488928d32e67ee268b56d5705381fd3aa5 Mon Sep 17 00:00:00 2001 From: Daniel Padrino Date: Thu, 16 Jul 2026 12:08:30 -0300 Subject: [PATCH] fix(lightning): send the LNbits api key as X-Api-Key header instead of query param The admin/wallet keys were landing in plain text in the LNbits access log on every lnurlp/lnurlw/payments call. LNbits reads X-Api-Key on the same endpoints, so the key moves to the header and the boltcards URL drops its redundant copy. Ports DFXswiss/api#4225 to this repo. --- src/integration/blockchain/lightning/lightning-client.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/integration/blockchain/lightning/lightning-client.ts b/src/integration/blockchain/lightning/lightning-client.ts index 3c30d810ee..f01a8e9ef7 100644 --- a/src/integration/blockchain/lightning/lightning-client.ts +++ b/src/integration/blockchain/lightning/lightning-client.ts @@ -534,7 +534,7 @@ export class LightningClient { async getBoltcards(adminKey: string): Promise { return this.http.get( - `${Config.blockchain.lightning.lnbits.boltcardsApiUrl}/cards?all_wallets=false&api-key=${adminKey}`, + `${Config.blockchain.lightning.lnbits.boltcardsApiUrl}/cards?all_wallets=false`, this.httpLnBitsConfig(adminKey), ); } @@ -596,8 +596,9 @@ export class LightningClient { httpsAgent: new Agent({ ca: Config.blockchain.lightning.certificate, }), - headers: this.lnBitsForwardHeaders(), - params: { 'api-key': adminKey, ...params }, + // key goes in the header, not the query string, to keep it out of LNbits access logs + headers: { ...this.lnBitsForwardHeaders(), 'X-Api-Key': adminKey }, + params: { ...params }, }; }