Macaroon

A macaroon is the credential format LND (Lightning Network Daemon) uses to authorize actions on a node — reading its state, sending payments, opening channels — instead of a traditional username/password pair. Different macaroon files grant different permission levels (read-only, admin, etc.).

Because a macaroon is the authorization — there’s no separate password check — anyone who obtains the file can act as if they were the node’s operator. This is exactly what made the BTCPay Server vulnerability serious: an attacker who could fetch a .macaroon file remotely didn’t need to guess a password at all.