Security checklist

The OpenAPI moves money. Please check every item.

Keys

[ ] The private key lives only on your servers: an environment variable, a file with mode 600, or a cloud key management service.
[ ] No private key in code repositories, logs, chat tools or tickets; don't publish the API base URL either (not in front-end pages, apps or public docs).
[ ] As few accounts as possible can view or regenerate keys in the merchant console; grant sub-accounts only what they need.
[ ] If you suspect a leak, regenerate the keys immediately and update your servers at the same time (old keys stop working at once).

[ ] The API is called over https:// with certificate validation enabled.
[ ] The IP whitelist contains only your own servers' outbound IPs.
[ ] Every order uses a unique merchant order number that you generate and store in your database.
[ ] After a timeout on order or payout creation, query first and retry only with the same merchant order number (see the end of Error codes).
[ ] Payout amounts and recipient details come from data already approved in your system, never straight from client input.

[ ] The callback URL is https.
[ ] Callbacks are decrypted, the merchant number is checked, and state and amount are verified with Get order — details.
[ ] The same order + state is processed only once (unique index in your database).
[ ] Crediting and recording "processed" happen in one database transaction, and success is returned only after it commits.
[ ] The callback endpoint limits the body size and doesn't log full bodies.

[ ] Reconcile daily with List balance flows (24-hour windows) against your own records.
[ ] Check any mismatch order by order with Get order, and contact the platform if in doubt.