Best Practices

A short checklist for a secure, reliable integration.

• Keep your secret server-side. Never ship it in a browser, mobile app, or public repo.
• Always use HTTPS. Every request and your return/cancel URLs.
• Cache the access token. Reuse it until expire_time, then refresh — do not fetch a new one per request.
• Verify on the server. Confirm the payment status (custom + amount) before fulfilling — the redirect alone is not proof.
• Be idempotent. Use a unique custom reference per order so retries never double-charge.
• Start in sandbox. Integrate and test against the sandbox base URL, then switch to production.
• Handle every error. Branch on type and message.code; show friendly messages.