Security

Use these practices when integrating VenPays.

Credentials

• Keep secret and legacy X-API-KEY values on your servers only
• The publishable key (pk_…) may be used in the JavaScript checkout SDK; it cannot charge or refund
• Never embed secret or legacy keys in frontend JavaScript or mobile apps
• Never log API keys, native session tokens, Apple payment tokens, or webhook secrets
• Rotate API keys and webhook secrets when staff change or a credential may have been exposed

Transport

• Use HTTPS for Live webhooks and return URLs
• Verify webhook signatures before trusting an event or updating orders

Application

• Confirm payments from webhooks and/or authenticated status checks — do not rely on browser redirects alone
• Treat pending as unknown — do not mark an order paid until you have a terminal success
• For native Apple Pay, reconcile on your backend when the SDK reports an uncertain outcome
• Prefer webhooks for asynchronous updates instead of aggressive polling

Reporting

Report security issues to security@venpays.com.