Skip to main content

Security Guide

Payments integrations should be designed so a leaked client token, duplicated event, or network retry cannot create an unauthorized payment.

Protect API keys​

  • Use ps_pk_test_... only with sandbox and ps_pk_live_... only with production.
  • Keep API keys on a server you control. Do not expose them in browser JavaScript, mobile apps, logs, screenshots, or source control.
  • Store keys in your deployment secret manager or environment variables.
  • Create a replacement key and deploy it before rotating or deleting an existing key in Settings > API Keys.
  • Remove keys that are no longer used and investigate unexpected key activity immediately.

The dashboard may label pk_... values as public keys, but the current direct API uses them to authenticate business operations. Keep them server-side and use the short-lived payment-session pattern where a supported client-side payment experience is needed. Production access also requires an IP allowlist for your server.

Secure webhooks​

  1. Receive the raw request body. Do not parse and re-serialize JSON before verification.
  2. Verify X-Payscribe-Signature with your webhook secret, X-Payscribe-Timestamp, X-Payscribe-Event-Id, and the raw body.
  3. Reject stale timestamps (the documented limit is five minutes).
  4. Store each event ID in a durable database with a unique constraint before changing business state.
  5. Return 200 OK quickly and process slow work asynchronously.

Follow the working examples in Webhooks & Events. IP allowlisting can be an additional control, but signature verification is required.

Handle sensitive payment data safely​

  • Do not store full card numbers or CVV values in your application, database, logs, analytics, or support tickets.
  • Redact API keys, authorization headers, card data, account numbers, and personally identifiable information before sharing diagnostics.
  • Restrict production dashboard access to people who need it, and review access when team members change roles.
  • Use HTTPS for every API request and webhook endpoint.

This guide does not make a compliance certification claim. Confirm your specific PCI DSS, privacy, regulatory, and data-retention obligations with your security and legal teams.

Report a security concern​

Send a concise report to support@payscribe.ng with the subject Security report. Include reproduction steps and impact, but do not include an API key, full card data, or production customer data.

Was this page helpful?

Report a docs issue →