# Payout whitelist

> A list of pre-approved payout addresses. How CryptoLike delays new entries, enforces the list for the cabinet and API keys, and what a refused payout returns.

Source: https://cryptolike.net/glossary/payout-whitelist
Updated: 2026-09-25

A list of destination addresses an account approves in advance, so money can leave only to those addresses even if a session or a key is stolen.

## How it works in CryptoLike

In CryptoLike an owner, admin or finance member adds an address in the cabinet (Withdrawals → Whitelist): the asset, the address and a label, confirmed with a fresh 2FA code. The entry activates after the account's delay — 24 hours by default, shown in `activates_at` — so a stolen session cannot redirect payouts at once. Removing an address needs no 2FA code and takes effect immediately, because it moves no money.

With the whitelist enforced (`whitelist_enforced`, switched on by an owner or admin with 2FA in the withdrawal settings), CryptoLike accepts payouts only to active whitelisted addresses — from the cabinet, the Telegram bot and API keys alike. Every other destination is refused with `403 forbidden`: whitelist the address and wait for it to activate, or switch enforcement off in the cabinet. In a CSV batch every row is checked, and one row with a non-whitelisted address rejects the whole file with a per-row report.

The whitelist is your own rule. Separately, the platform may refuse a destination it does not accept (`422 address_refused`): use another address. Pair the whitelist with [dual approval](https://cryptolike.net/glossary/dual-approval) for large payouts; the full flow is in the [crypto mass payouts guide](https://cryptolike.net/guides/crypto-mass-payouts) and the [mass payouts use case](https://cryptolike.net/use-cases/mass-payouts).

Every payout control, with its default, is on the [security page](https://cryptolike.net/security).