## How it works

Keep sensitive payment input in the hosted checkout or processor-hosted fields. Your application should work with payment IDs, tokens and signed events.

## Implementation

Store secret keys on the server, redact them from logs, verify webhook signatures against the untouched body, and give team members only the access they need. Use a separate integration key per service and rotate a suspected compromised key. Check the checkout origin before trusting iframe messages. Report a security issue privately to sales@spicepay.net without sending card details or active credentials. This documentation does not claim a separate certification for your integration.

## In this area

- What SpicePay does
- What you must do
- Report a vulnerability

## Related guides

- [API keys](/docs/general/authentication/)
- [Webhook verification](/docs/payment-api/webhook-verification/)
- [Roles & permissions](/docs/dashboard/team/roles/)