Payout whitelist

A list of destination addresses an account approves in advance, so money can leave only to those addresses even if a session or a key is stolen.

#How it works in CryptoLike

In CryptoLike an owner, admin or finance member adds an address in the cabinet (Withdrawals → Whitelist): the asset, the address and a label, confirmed with a fresh 2FA code. The entry activates after the account's delay — 24 hours by default, shown in activates_at — so a stolen session cannot redirect payouts at once. Removing an address needs no 2FA code and takes effect immediately, because it moves no money.

With the whitelist enforced (whitelist_enforced, switched on by an owner or admin with 2FA in the withdrawal settings), CryptoLike accepts payouts only to active whitelisted addresses — from the cabinet, the Telegram bot and API keys alike. Every other destination is refused with 403 forbidden: whitelist the address and wait for it to activate, or switch enforcement off in the cabinet. In a CSV batch every row is checked, and one row with a non-whitelisted address rejects the whole file with a per-row report.

The whitelist is your own rule. Separately, the platform may refuse a destination it does not accept (422 address_refused): use another address. Pair the whitelist with dual approval for large payouts; the full flow is in the crypto mass payouts guide and the mass payouts use case.

Every payout control, with its default, is on the security page.