BtcPayServer

This release fixes the problems that a full review of the app found: security hardening, safer payments, alerts that do not stop, and clearer screens. It is a full release.

Requires Android 15 (API 35) or later, on an arm64-v8a phone. From this release, the APK has native code for arm64-v8a only.

Install it over 0.2.7. The signing key is the same. Accounts you already added keep working.

Changed

• The APK is about 180 KB smaller (estimate). It has no native libraries for x86, x86_64 or armeabi-v7a.
• Settings shows a row when Android blocks the app's notifications. The row opens Android Settings.
• Refund shows "Bitcoin", "Lightning" or "LNURL" on the "Paid with" chips, and the chips go onto a second line when necessary.
• The recovery phrase of a new wallet shows numbered words.
• Apps of plugin types open in the browser. Before, they opened in the point of sale editor.
• The app shows Create, Archive, Refund, store settings links and the transaction label editor only when the API key can do the action.

Fixed

• An invoice that the server could not return stopped the alerts of its store. Now the other invoices are still checked.
• Home scan: a scan before the payment methods loaded opened Send with no wallet. Now Send waits for them.
• Wallet Receive: with an amount that is not valid, the QR code showed only the address. Now no code shows until you correct the amount. An older response can no longer replace a new address.
• Pull payments: the list now reloads when you come back, so a new or archived pull payment shows.
• Invoice details: a refused "Mark as" or archive now keeps its error on screen.
• Invoice list: a filter or search change now shows progress.
• Checkout: the "paid" vibration plays one time only. The QR code goes away at the expiry time, also when the polls fail.
• Terminal: the keypad does not change the amount while a charge is in progress.
• New invoice and Refund ask before you discard a filled form.
• Send: a bitcoin: URI that you type stays in the field, and the review reads its amount.
• Lightning: a node address with no host is refused before the confirmation. A very large flat fee limit or receive expiry is refused.
• Accounts: "Revoke and remove" works for a key that is already revoked, and a back press cannot stop it halfway. A rename does not reload the session.
• Notifications: "Mark all as seen" marks all of them, not only the first 50.
• Payout processors: the interval field accepts a decimal point.
• Store users: the role is also sent under the key that BTCPay Server 2.4.4 uses.
• A pasted API key with hidden characters failed with "Could not reach the server". Now these characters are removed. For an .onion server, the app tells you to open the approval page in Tor Browser.
• TalkBack speaks error banners.

Privacy and security

• Other apps cannot draw overlays over the app (protection against tapjacking).
• Secret fields tell the keyboard not to learn what you type.
• The app does not send an extended private key (xprv, zprv and others) to the server from the derivation scheme field.
• An empty or truncated encrypted file is put in quarantine and the app lock stays on. Before, an empty settings file turned the app lock off.
• The StrongBox fallback also works on phones that give a general key error.
• With no screen lock on the phone, the lock screen tells you to set one. It does not say "try again".
• An on-chain fee rate above 500 sat/vB shows a warning when no fee estimate is available.
• You cannot remove the active account while a payment is in progress.
• No background job runs when the app has no account.
• A JSON decode error shows a fixed text, not the server's data.

Files

Verify the download

• APK SHA-256: 04fc8a84c604ac20694b8ce8df207f76b056d0f1cfca0a17e82c4d15bdf6ec62
• Signing certificate SHA-256: 67ac728e39bb4866e613c8f676ab4cbd2baaa6a0d2728c53dcf9913f993727ba

shasum -a 256 -c btcpayapp-0.2.8.apk.sha256
apksigner verify --print-certs btcpayapp-0.2.8.apk

Do not install an APK with a different certificate.