Security

How it works

Keep sensitive payment input in the hosted checkout or processor-hosted fields. Your application should work with payment IDs, tokens and signed events.

Implementation

Store secret keys on the server, redact them from logs, verify webhook signatures against the untouched body, and give team members only the access they need. Use a separate integration key per service and rotate a suspected compromised key. Check the checkout origin before trusting iframe messages. Report a security issue privately to [email protected] without sending card details or active credentials. This documentation does not claim a separate certification for your integration.

In this area

• What SpicePay does
• What you must do
• Report a vulnerability

Related guides

• API keys
• Webhook verification
• Roles & permissions