Security Best Practices
Key hardening rules for HellOOpass integrations.
Secure keys, verify events, and never trust client state.
Checklist
- Secrets: Store in env vars/secret manager; never in code or client apps.
- Rotation: Rotate keys immediately if leaked.
- Per env: Separate keys/secrets per sandbox and production.
- HTTPS: Enforce TLS on all hops.
- Webhooks: Verify signatures with raw body (constant-time).
- Verification: Confirm payments via webhook or server-side verification.
- Idempotency: Use idempotency keys and idempotent handlers.
- Least privilege: Restrict dashboard/API access; enable 2FA.
- Safe logs: Never log secrets or full payment details.
- Validate inputs: Sanitize and validate server-side.
If a key leaks
Create a new key in the merchant dashboard.
Deploy to all servers and update secrets.
Revoke the old key and monitor traffic.
Audit logs for misuse.
| Rule | Action |
|---|---|
| Never | Send secret keys from clients or commit them. |
| Always | Verify payments server-side and verify webhook signatures. |
Related: Authentication