Five habits that keep a payments integration secure
Practical rules for storing keys, trusting webhooks and limiting damage when something leaks.
Most payment incidents do not come from clever attacks. They come from a key in a public repository or an order marked paid because someone visited a success URL. These five habits prevent most of them.
1. Keep keys on the server
API keys and merchant tokens belong in your server's configuration or secret store. Anything shipped to a browser or a mobile app can be read by anyone.
2. Use one key per environment
Separate keys for development, staging and production mean a leaked test key never touches live money, and you can rotate one without breaking the others.
3. Trust webhooks, not redirects
The customer's browser returning to your success page tells you nothing. Fulfil orders when the payment webhook arrives and the session status says the payment succeeded.
4. Rotate on suspicion
If a key may have been exposed, revoke it and issue a new one from API keys straight away. Rotating takes a minute; investigating a leak takes much longer.
5. Turn on two-factor sign-in
Whoever can sign in to your account can create keys and change payout details. Protect every user on the account, not just the owner.