Security

Protect your key and your orders.

Anyone who holds your API key can log in and create payments as your business, and anyone can change what a customer's browser sends. These few rules keep your money and your orders safe.

Keep the API key, token and HMACKey on your server#

Never put your API key, the login token or your HMACKey in a website, mobile app, or any code a customer can download. Anyone who has them can create payments and read payments as you.

Store them in environment variables or a secrets manager.
Never commit them to Git.
Use one API key per system, so you can replace one without stopping the others.
If a key leaks, rotate it in the portal at once.
Send only completionUrl to the customer — the create response also contains your HMACKey.

Always confirm on your server#

The landingUrl redirect can be faked. Do not trust it.
A request to your callback URL can be faked. Treat it as a signal and call Get a payment.
Release goods only when Get a payment returns SUCCESSFUL.
Check that amount and externalUniqueId match your own order.

Use HTTPS#

Use https:// for your landingUrl and callback URL in production. Use HTTPS in sandbox too where you can.

Separate sandbox and production#

Sandbox and production use different accounts, keys and base URLs. Keep them in separate configuration so a test key never ends up in production, or the other way round.

Fulfil once#

Webhooks can repeat and customers can retry. Record each paymentId you process and each order you fulfil, so nothing ships twice.