Security

The Checkout API is designed so that a mistake on your side can’t take a buyer’s money or yours. These practices keep it that way.

Secret keys

• Keys are shown once. SaphraONE stores only a hash and can’t show a key again.
• Keep keys in a secrets manager or environment variables. Never commit them, log them or send them to a browser.
• Use one key per site or service, named after it, so you can revoke one without touching the others.
• A business can have up to five active keys. Only the owner and admins can create or revoke them.
• The owner is notified whenever a key is created. If you didn’t create it, revoke it straight away.

Rotating a key

1. Create the new key

   Create it in the console and deploy it to your servers.

2. Watch the old key go quiet

   The console shows when each key was last used.

3. Revoke the old key

   Revoking takes effect immediately: calls with it fail with 401.

What a leaked key can and can’t do

Because payments always go to your own business wallet, a stolen key can’t redirect funds. Revoke it anyway: it could be used to send buyers to sessions you didn’t intend.

Verify on the server

The return to success_url can be forged by anyone. Always retrieve the session with your key and check its status, amount, currency and client_reference_id against your order before fulfilling.

Browser calls are refused

The API rejects cross-site requests from browsers with 403. Call it only from your server.

What protects your buyers

• The hosted page shows your verified name, logo and ONE ID, so buyers can tell it’s really you.
• Live keys require a verified business, so impostors can’t take live payments under a made-up name.
• The page can’t be framed by another site, which blocks clickjacking.
• Buyer email, metadata and your order id are never shown on the payment page.