Security
IOT-Lightning-Bridge is built on a simple principle: the operator should be able to verify everything, and trust nothing they can't verify.
Payments land in our custodial LNBits gateway and are auto-forwarded within seconds to the Lightning Address you set. We hold sats only for the brief settlement window — minus the configurable platform fee.
LNBits payment webhooks are HMAC-verified before processing, and the resulting payment event is pushed to your own MQTT broker over your credentials — Home Assistant reacts only to messages from your bridge.
Lightning replaces card payments entirely. No PCI scope, no chargebacks, no PII required from the customer.
Machine API keys are per-account and rotatable. MQTT broker credentials are encrypted at rest with a server-side key — never exposed back to the client.