Security

• Keep keys in server-side secrets or environment variables.
• Call Paylinky only from your backend; send the browser a payment_link, never a key.
• Use a distinct key per environment/service and roll a key immediately if exposed.
• Verify every webhook signature; reject old timestamps.
• Use HTTPS for webhooks, redirect URLs and your whole site.
• Make fulfilment idempotent (transaction_id, merchant_reference).
• Validate amounts server-side: never trust an amount sent from the browser.
• Log transaction_id, reference and webhook X-Paylinky-Event-Id for reconciliation.
• Do not log full keys, secrets or customer PINs/OTPs.

Go-live checklist

1. KYC approved and live key activated.
2. All sandbox scenarios tested (success, pending, failed, cancelled, OTP).
3. Webhook endpoint public, HTTPS, signature verified, idempotent.
4. /countries loaded dynamically; unsupported operators handled.
5. Timeout handling: status check before retry.
6. Keys stored in secrets; sandbox and live keys separated.
7. Customer-facing messages for pending, failed, expired.
8. Support contact visible to your customers.

Account protection

Paylinky stores API keys hashed, applies a per-key rate limit (default 120 requests/minute), logs every API request, and lets administrators suspend accounts or revoke keys instantly.