XMRWallet for Merchant Receivers: Setting Up View-Only Monitoring for Incoming Transactions

An online retailer, service provider, or payment processor faces a recurring operational problem: customers send Monero payments, and someone must verify that the funds arrived correctly without exposing the business’s spending ability to every employee with access to the wallet. Traditional approaches involve either sharing a full private spend key—which defeats security separation—or relying on a third-party payment processor that introduces custody risk, transaction fees, and regulatory exposure. Monero’s design offers a cleaner alternative through view keys, which allow independent verification of incoming transactions without the ability to move funds.

XMRWallet, a non-custodial Monero wallet, supports this separation through its view-only mode. A merchant can generate a view key from a secure, offline wallet instance and import that view key into a separate monitoring instance accessible to customer-service or accounting staff. The monitoring instance can scan the blockchain, display transaction history, and confirm that specific amounts arrived at designated addresses—all without ever having access to the spend keys. This architecture preserves operational transparency while maintaining the principle that only the owner of the spend key can authorize outgoing funds.

Why view-only wallets matter for merchant operations

Monero’s privacy design complicates payment verification in ways that Bitcoin or Ethereum do not. On transparent blockchains, anyone can visit a block explorer and confirm that an address received a specific amount at a specific time. Monero deliberately obscures amounts, addresses, and sender identity through ring signatures, stealth addresses, and confidential amounts. This protection benefits users—but it also means that only someone holding the private view key for an address can detect incoming transactions assigned to it.

A full private spend key grants two distinct capabilities: the ability to view transaction history and the ability to authorize outgoing transfers. A view key grants only the first. For a merchant operation, this is the critical distinction. A cashier, customer-support representative, or accountant may legitimately need to tell a customer “Yes, we received your payment on Tuesday at this amount”—but they should not be able to move the business’s Monero balance to a personal address. View-only access creates an audit trail of who checked what, when, without creating the temptation or opportunity for misappropriation.

The operational model unfolds in layers. First, the business generates a wallet and extracts its view key in a secure environment, then stores the spend key offline in a cold wallet or multisig arrangement. Second, the view key is imported into monitoring instances that run on customer-facing systems or employee workstations. Third, when a customer initiates a Monero payment, the monitoring instance scans the blockchain, matches the incoming transaction to the customer’s account, and sends an automated or manual confirmation. Throughout this process, the spend key never touches the systems that employees use daily.

Deriving and storing view keys securely

The first operational step is generating a Monero wallet and extracting its view key without exposing the spend key. XMRWallet’s architecture supports this through its non-custodial design: the user retains full control of key material, and no passwords or recovery seeds are stored server-side. When setting up a merchant wallet, the business should generate it on an offline device or air-gapped computer that never touches the internet during key creation.

The wallet generation process produces a 25-word recovery seed. This seed should be written down and stored securely in a physical safe, vault, or secure document repository—not on any internet-connected device. The recovery seed must be protected as if it were equivalent to the business’s banking credentials, because it is: anyone with that seed can reconstruct the spend key and move all funds. Once the seed is written and verified, the user can derive the private view key from the wallet file or recovery phrase.

XMRWallet allows exporting the view key independently. The process depends on the wallet software, but the general principle is that the view key is a distinct cryptographic value that can be extracted and shared separately from the spend key. Some Monero software displays the view key directly in the wallet settings; others require using a CLI tool to read the wallet file. The critical practice is to extract only the view key—never export, photograph, or transmit the full wallet file or recovery seed when the goal is to create a view-only monitoring instance.

Once the view key is extracted, it should be treated as a credential that requires some protection but is fundamentally lower-risk than the spend key. The view key allows someone to see the transaction history and balance associated with the wallet, which may be sensitive business information. Employees should not have unlimited access to multiple customers’ view keys; instead, the business should assign view keys to specific staff based on job responsibilities. A customer-service representative handling refund requests may need access to one view key; an accountant preparing tax records may need access to a different set. This granular approach takes advantage of view-only mode’s main benefit: supporting access control without exposing the keys that actually move money.

Importing view keys into monitoring instances

Once the view key is extracted, it can be imported into a separate XMRWallet instance designated for monitoring and customer verification. This instance should run on systems used for daily operations—customer-service workstations, accounting computers, or payment-processing servers—where the spend key should never appear. The wallet access process for a view-only wallet differs slightly from a full wallet because the monitoring instance contains only the view key, not the recovery seed or spend key.

When creating a view-only wallet in XMRWallet, the user selects the option to import a view key instead of creating a new wallet or importing a recovery seed. The view key is entered, and the system reconstructs enough information to scan the blockchain for transactions assigned to that wallet’s addresses. This reconstruction happens locally on the device where the wallet is running—no view key material is transmitted to XMRWallet’s servers or any third-party service. The wallet dashboard then displays the balance, transaction history, and incoming payments associated with that view key.

One practical detail matters here: the view-only wallet still requires connecting to a Monero node to synchronize the blockchain and scan for relevant transactions. XMRWallet supports both local node connections (running a Monero daemon on the same device) and remote node connections (using a community or third-party node service). For a merchant monitoring setup, the choice carries privacy and reliability trade-offs. A local node is slower to sync but fully under the business’s control. A remote node is faster but means the node operator can observe which wallet addresses are being scanned, potentially revealing transaction timing or business volume to that operator. For many merchants, a remote node is acceptable because the view key itself does not reveal the spend key, but the business should be aware of what information is being observed.

Verifying incoming payments through transaction history

The primary use of a view-only monitoring instance is confirming customer payments. When a customer claims to have sent Monero, the merchant can open the monitoring wallet, check the transaction history, and locate the incoming transaction. Because the view key allows the wallet to identify transactions belonging to the address, the transaction history will display arriving funds with timestamps and amounts.

Monero’s privacy-first design means that the display differs from what a transparent blockchain explorer would show. The wallet dashboard shows amounts and dates that are meaningful to the wallet holder—because the view key decrypts the transaction details—but these details are not visible to observers without the view key. From a merchant’s perspective, this is an advantage: customers cannot easily verify their own payments through a public website, which is good for privacy but requires the merchant to explicitly confirm the transaction. A customer-service representative can tell the customer “Your transaction was received at 14:32 UTC on the 15th in the amount of 0.5 XMR,” and that confirmation is backed by the wallet’s own record rather than relying on the customer’s own observation.

The transaction history feature is designed to show all incoming and outgoing transactions associated with the view key. For a pure monitoring instance, there should be no outgoing transactions—because the instance has no spend key, it cannot authorize transfers. If the monitoring wallet displays outgoing transactions, something is wrong. Either the view key is being used across multiple independent wallets (which should not happen), or a previous spend key import was not properly isolated. In practice, this is not a common concern if the setup procedure is followed: import only the view key, not any spend-key material, and the monitoring instance will remain read-only.

Automating payment confirmations and account reconciliation

For a small merchant operation, manually checking the transaction history each time a customer reports a payment is workable but not scalable. Larger or higher-volume operations benefit from automated systems that scan the monitoring wallet and cross-reference received funds with customer orders or invoices. This automation still respects the view-only security model: the automation code has access to the view key and can read transactions, but it never has access to the spend key.

A practical automation workflow involves a script or application that periodically calls XMRWallet’s API or monitors the wallet’s local data to detect new incoming transactions. The script matches incoming amounts and addresses to customer records, updates order status from “awaiting payment” to “payment received,” and optionally sends an automated confirmation email. For highly sensitive operations, the automation can trigger a manual review step where a staff member confirms the transaction before marking the order as paid and proceeding to fulfillment.

This automation creates another important operational benefit: a complete audit trail. Every time the system detects a payment, it logs the transaction ID, amount, timestamp, and which customer account received the credit. If a customer disputes whether a payment was received, the merchant can produce a timestamped, cryptographically linked record. Unlike traditional payment processors, the merchant owns this record because it is derived from the view key and the blockchain itself, not stored in a third-party database subject to service terms or data breaches.

For businesses with multiple wallet instances or multiple currencies, the monitoring setup can be extended to coordinate across several view keys. A large e-commerce platform might maintain view keys for different product categories, affiliates, or regional operations, each in its own monitoring instance, feeding into a central reconciliation system. The spending authority remains separated: only designated individuals holding the corresponding spend keys can move funds, while the audit and confirmation layer is accessible to broader teams. This architecture supports both operational transparency and financial security simultaneously.

Setting up monitoring across multiple devices and employees

As a business grows, multiple staff members may need access to payment confirmation capabilities. XMRWallet’s non-custodial design supports this without requiring the business to share passwords or recovery seeds that would unlock the spend key. The view key can be safely shared with multiple employees, each running an independent XMRWallet instance on their own device. Each employee’s wallet dashboard shows the same transaction history and balance because they are all viewing the same blockchain data through the same view key.

Access control in this scenario should be enforced at the device and organizational level, not at the wallet level. A view-only wallet has no built-in user-management features: anyone with the view key can see the full transaction history. The business should therefore ensure that the view key is only installed on devices issued to employees who legitimately need access to payment verification. If an employee leaves, the business should delete the view key from their assigned device. If a device is lost or stolen, the view key should be rotated—a process that requires regenerating the wallet from the spend key and extracting a new view key, then updating all monitoring instances.

For higher-security operations, the business can segment access by creating multiple wallet instances and assigning different view keys to different teams. For example, a customer-service team might receive access to one view key to confirm customer payments, while an accounting team maintains access to a different view key that tracks internal rebalancing or withdrawal transactions. This segmentation requires maintaining multiple independent Monero wallets from the same organization, each with its own spend and view keys, but it provides stronger compartmentalization.

All monitoring instances should follow basic device hygiene practices. Automatic session expiration after a set period of inactivity reduces the risk that a forgotten or abandoned workstation becomes an attack surface. Local data should be cleared after use if the device is shared. The devices running monitoring instances should have standard security practices in place: operating system updates, antivirus software, and firewall rules restricting outbound connections to only necessary services. Because the view key allows sensitive information to be displayed, the device should not be accessible to untrusted users or located in a high-risk physical environment.

Limitations and when to involve additional services

View-only monitoring works well for confirming that payments have arrived, but it is not a complete payment-processing solution. The view key cannot generate new addresses, authorize refunds, or integrate directly with accounting or fulfillment systems without additional software layers. For a simple operation—a small service provider accepting a handful of Monero payments monthly—manual monitoring via the wallet dashboard is sufficient. For larger operations processing hundreds of payments daily, integrating a Monero payment processor or using merchant-specific tools may be more practical.

Another important limitation: the view key can monitor the primary wallet address and its subaddresses, but Monero’s privacy architecture means that the view key holder cannot independently confirm which customer was the sender. The amount and approximate timing can be matched to an order, but not with cryptographic certainty. This is by design—Monero protects sender privacy—but it means that the merchant must maintain its own mapping of expected customer amounts and payment timestamps. If customer A is expected to send 0.5 XMR and an incoming transaction of 0.5 XMR arrives within a plausible timeframe, the merchant reasonably concludes that the payment came from customer A; the view key confirms the amount arrived, but not the sender’s identity.

For even stronger confidence, merchants can request that customers use a specific subaddress for each order. Monero wallets, including XMRWallet, support subaddresses—distinct payment addresses derived from the same view and spend keys. By assigning a unique subaddress to each customer or invoice, the merchant can identify which order was paid without relying on timing alone. The view key allows monitoring of all subaddresses at once, so the setup process is the same, but the operational transparency improves. More information about setting up and managing view-only wallets is available through sites.google.com/xmrwallet.cfd/xmrwallet-official/, which covers wallet creation, key management, and integration approaches.

Recovery and key rotation procedures

Because monitoring instances contain only the view key and not the spend key, loss of a monitoring device or compromise of a view key is recoverable without endangering the funds themselves. If an employee’s laptop is stolen, the view key on that device should be considered compromised. The business can delete the view key from all other monitoring instances and generate a new one from the authoritative spend key stored in the cold wallet. The old view key becomes useless once the wallet is regenerated because the wallet’s address structure changes.

Key rotation should be planned as a routine operational procedure, not an emergency response. A quarterly or semi-annual rotation of view keys used for monitoring ensures that if an employee leaves or a device is lost, the impact is limited. The rotation process is straightforward: retrieve the spend key from cold storage, regenerate the wallet to produce a new view key, and update all monitoring instances. This procedure does not affect the wallet’s balance or transaction history—Monero’s deterministic key derivation ensures that the same spend key always regenerates the same wallet and funds. The new view key is simply another way to monitor the same wallet.

Documentation of the key rotation schedule is essential. A business should maintain a log indicating which employees have access to which view keys and since when. If an employee is dismissed, the log clarifies which view keys need to be rotated. If a security incident occurs—a device loss, malware detection, or unauthorized access—the log provides context for determining which wallet instances may be at risk and which require rotation.