Private credentials
API keys are managed server-side. Existing keys are stored as hashes and are never returned by ordinary dashboard requests. Newly issued keys are displayed once.
CONTROL AT EVERY LAYERClear boundaries.
Clear boundaries.
Considered security.
Protect the connection, separate each business and make sensitive changes accountable.
Layered API access
Active merchant status, approved domains and allowed server IPs are validated by the API gateway. Browser code should never contain a private API key.
Assigned merchant access
Root controls administrative access. Other admins need an explicit permission and a merchant assignment before they can view or change that merchant’s data.
Admin sign-in checks
Administrative sign-ins require a password and email verification code. Sensitive credential and funding actions also require password confirmation.
Traceable changes
Administrative actions and service funding are recorded with references. Payment callbacks are verified before a service-wallet credit can be applied.
Private account pages
Dashboards require authentication and are excluded from the public sitemap. Account pages and API responses are marked for private, non-indexed handling.
Integration responsibility
Keep private keys on your server, validate wallet callback signatures and process transaction references exactly once. Your team should review the product documentation before activation.
Read integration documentation