- Keys. Keep secret keys on your server, never in an app, a browser or a repository. Give each system its own key with only the scopes it needs. Roll a key at once if it may have leaked.
- Customer tokens are as sensitive as a password for 15 minutes. Keep them on your server, never log them, and never pass them to another customer.
- Card numbers must never touch your systems. Collect cards only on KetaPay’s hosted checkout.
- Webhooks. Verify every signature against the raw body, reject old timestamps, and fetch the object before acting on large amounts.
- HTTPS only. Plain HTTP requests are refused, not redirected. TLS 1.2 or later.
- Your customers’ data. You receive your customers’ names, emails and phone numbers back from KetaPay. Handle them under your data processing agreement with KetaPay and the Nigeria Data Protection Act 2023.
Integrate
Security
What you keep safe, and what KetaPay does for you.