Issuer keys and rotation

Each loyalty program has a permanent issuer address. That address identifies the brand in signed issuances and redemptions, and the factory finds the program using the issuer address and loyaltyId. Loyfin does not provide a function to replace the issuer address across existing programs.

A program's admin owner is separate. Calling transferOwnershipgives another wallet control of that program's settings. It does not move issuer identity or issuance and redemption signing authority. Changing the admin owner also does not redirect the factory's issuer fee share, which is paid to the issuer address.

Choose the issuer wallet before creating the first program. An account’s assigned wallet can sign through explicitly authorized API signing; see the Signing options guide. The following rotation guidance applies to externally managed wallets. Teams that need signer rotation or recovery should use a compatible multisig or contract wallet and configure those capabilities there. Loyfin supports contract-wallet signature validation through ERC-1271.

The issuer wallet must support the required signature validation and receive USD fee payments. A wallet's owners and signing threshold are managed through that wallet, independently of Loyfin's API key and each program's admin settings.

Suppose contract wallet W is the issuer of two loyalty programs and key A is an authorized signer. The team uses W's own controls to replace A with B. Both programs still have W as their issuer. B can authorize new actions under W's rules without changing either program's issuer address or moving customer balances.

A signature accepted when a checkout session was created may no longer be valid at execution. Removing a multisig owner, changing its threshold, or changing its validation policy can invalidate earlier signatures. The effect depends on the wallet implementation and the signatures collected.

A distant deadline, or deadline = 0, does not guarantee that a signature remains valid after those changes. The deadline only limits when the signed action can execute. Current signature validation, unused nonce, expiry, and program capability checks still apply. Invalidating old signatures can be an intentional response to a compromised key.

Before planned signer changes, identify pending issuances and redemptions and decide how to handle them under your wallet's policy. A failed signature check is not sufficient evidence to release reserved points or create a replacement conversion: the transaction may already have executed, and another wallet configuration change may make an old signature valid again. Follow Receipts and webhooks to reconcile completed actions and safely release unused reservations.

• Manage issuer keys, wallet owners, signing thresholds, and recovery through your chosen wallet or signing provider.
• Test how your wallet handles existing signatures when its signers or policies change.
• Use bounded action deadlines where practical and track every pending conversion in your backend.
• Reconcile affected checkouts and customer balances when changing the signing configuration.

Loyfin verifies authorization, coordinates checkout, and reports transaction outcomes. Assigned-wallet API signing uses explicitly authorized delegation. For external wallets, Loyfin does not choose multisig owners, override signature rejection, or restore signing access. See Admin controls for the separate settings a program owner can change.