API credentials
Keep keys server-side, use separate test and live keys, rotate and revoke keys after suspected exposure. Enable account MFA where available. Never send secrets in support messages or browser requests.
Protect your integration
Practical guidance for API keys, signed webhooks, trusted provider callbacks, account access and vulnerability reporting.
Webhook authenticity
Validate the exact raw request body with the endpoint secret, timestamp and event ID. Deduplicate events and verify the original order amount, currency, environment and final settlement state before fulfillment.
Webhook examples →Payment status
Browser redirects are not payment receipts. A live payment must have authenticated completed status and confirmed settlement before goods or access are released.
Responsible disclosure
Report suspected security issues privately to our support email with reproduction details that do not include third-party personal data. Do not exploit accounts, move funds, scan unrelated systems or publish secrets.
Report a security issue →Do you need to verify your own payment’s progress?
Troubleshooting and support ↗