Cowrie Research

onboard-company-primary-sources-2026-08-12

4 min read

Onboard company primary-source snapshot

Fetched: 2026-08-12 UTC

1) Current operator identity and regulatory shell

Source: https://www.onboard.xyz/ Source: https://www.onboard.xyz/terms

Selected excerpts and signals:

Onboard operates under financial regulatory oversight across three continents.

Registered as a Money Services Business (MSB) with FinCEN, United States

Registered with FINTRAC as a Money Services Business, Canada

Backed by CBN and SEC-licensed infrastructure in Nigeria

These Terms of Service (“Terms”) govern your use of the financial services provided by Gopay Financial Services Inc. (“Gopay”, “we”, “us”, or “our”), doing business under the brand name Onboard Pay.

Gopay Financial Services Inc. is a federally incorporated Canadian corporation … registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Money Services Business (MSB)

Additional signals:

  • The current homepage is no longer centered on the older P2P protocol narrative; it is centered on business payments, FX payouts, and a regulated service shell
  • The terms make the named legal operator explicit, which is the clearest current evidence that the control surface belongs in companies/

2) Product shell now being sold by the company

Source: https://www.onboard.xyz/ Source: https://www.onboard.xyz/direct Source: https://onboard.xyz/merchant-application

Selected excerpts and signals:

Move money without borders

Business FX and payouts for companies moving money across borders.

Receive Payments Globally

Multi-currency Transactions

Real-time Payouts

API Access

Convert directly to your bank or mobile money account. Send USDT or USDC, receive cash in minutes.

Instant Pay helps you skip the multiple steps and waiting times, and complete crypto to cash transactions in seconds.

Additional signals:

  • The live surface now spans business FX and payouts, API access, direct stablecoin-to-cash, and merchant-liquidity workflow rather than only a neutral marketplace protocol
  • The Direct page is especially useful because it shows the operator packaging bank/mobile-money linkage, supported-chain policy, and lifecycle visibility into one hosted settlement path

3) Dashboard, API credentials, and payout authorization workflow

Source: https://docs.onboard.xyz/guides/getting-started/set-up Source: https://docs.onboard.xyz/guides/api-concepts/api-credentials Source: https://docs.onboard.xyz/api-reference/authentication

Selected excerpts:

To start integrating with the Onboard Business API, you first need an Onboard Business account.

  1. Apply for an account at business.onboard.xyz/apply.
  2. Once approved, sign in to the Business Dashboard.
  3. From the dashboard, create your API credentials and configure a webhook URL.

API credentials authenticate your requests to the Onboard Business API. You create and manage them from the Business Dashboard.

Add the IP addresses your servers will call the API from. IP restriction is required for any key that will initiate withdrawals (cash payouts, crypto transfers)

Every request to the Onboard Business API must include your API key and an HMAC-SHA256 request signature — there is no unsigned tier.

Additional signals:

  • This is strong evidence that the real operating boundary is not just the API schema or the old protocol docs; it is the dashboard approval and credential shell
  • IP-whitelisting for payout-capable keys is especially useful because it shows where production money-movement authority is actually being mediated

4) Webhook and lifecycle-truth publication

Source: https://docs.onboard.xyz/guides/api-concepts/webhooks-setup

Selected excerpts:

Webhooks notify your systems in real time when account or transaction activity happens — a deposit lands, a payout completes, a beneficiary is added.

In the Business Dashboard … save your endpoint URL. A webhook secret is generated for you at the same time.

Every delivery is signed with x-signature and x-timestamp headers generated from your webhook secret.

Deliveries are retried with exponential backoff until your endpoint returns 200 OK.

Additional signals:

  • Onboard is the publication boundary for account and transaction lifecycle truth in the hosted path
  • The webhook secret lifecycle, signing behavior, and retry semantics all live inside the same company-run dashboard shell as API-key issuance

5) Service scope named in the terms

Source: https://www.onboard.xyz/terms

Selected excerpts:

Through the Onboard platform, including mobile applications, web applications, APIs, and other interfaces made available by Gopay (the “Platform”), Gopay provides eligible Customers with access to the following services:

  • Multi-currency accounts and virtual accounts
  • Payment collection and payout services
  • Domestic and cross-border payments
  • Foreign exchange conversion services
  • Treasury and settlement services
  • Other financial services that may be made available by Gopay from time to time

Gopay may decline to open an account or provide Services at our sole discretion

Additional signals:

  • The terms make account opening and service access explicitly discretionary, which is exactly the kind of operator-controlled admission boundary that belongs in companies/
  • The named service scope is much broader than a thin checkout or one-chain protocol page

Notes

  • The older onboard-primary-sources-2026-04-26.md packet still matters for the protocol / exchange / connect architecture and should remain the main source for the project-layer note.
  • The current live materials justify a separate company/entity note because the branded product family now clearly runs through a regulated dashboard, credential, webhook, and payout-authorization shell.

Graph View