Self-custody applied to getting paid.

Follow the money past the button.

A checkout button can say Bitcoin while the merchant receives an internal balance with a provider. The customer has paid. The merchant may still depend on another party to release the proceeds. Those are separate events.

Draw the flow from the customer’s wallet to the final receiving wallet. Label the entity at each step. Then ask who can sign a transaction, delay a withdrawal, or change the destination. A payment badge says little about who controls the money.

A payment badge says little about who controls the money.

Separate observation from signing.

For an existing on-chain wallet, BTCPay Server can derive receiving addresses from an extended public key and monitor payments without the private keys. Its documentation also distinguishes that arrangement from server-hosted hot wallets and Lightning configurations that involve spending access. The setup matters.

Treat a claim of receive-only operation as a claim about a specific configuration. Ask which credentials are present, what they permit, and where they are stored. Do not extend an on-chain statement to every other payment method merely because the same checkout displays them.

An invoice needs a lifecycle.

Receiving an address is not the whole checkout. The business needs to match the payment to an order, distinguish an unpaid invoice from a confirming payment, and decide what happens when the amount is short, late, or duplicated.

Write those states before designing the success screen. A return to your website is not proof of settlement. The system should establish payment from the receiving service’s verified records, then move the order forward once. Buyers need a reference they can quote and clear instructions when the normal path fails.

Refunds need their own process. Identify who authorizes one, which wallet sends it, how the destination is confirmed, and which record closes the loop. Self-custody transfers responsibility along with control.

Account for the remaining dependencies.

Removing a custodial intermediary does not remove networks, software maintenance, wallet security, accounting, or support. A payment system still needs someone to monitor it and restore it when something breaks.

Keep a written distinction between the properties of Bitcoin, the permissions of your software, and the conditions attached to any other asset you accept. A stablecoin is not Bitcoin with a different unit of account. Do not carry a claim from one rail onto another without checking it.