Security Best Practices

Protect API keys, webhook secrets, and merchant operations when integrating Genuka Pay.

Introduction

Genuka Pay should be integrated as a backend-to-backend system with strict control over credentials, signatures, and operational boundaries.

Key Security

Keep API credentials server-side and rotate them when access or infrastructure changes.

Webhook Security

Verify signatures before processing any incoming event or mutating business state.

Operational Controls

Protect sensitive data, separate environments, and monitor abnormal activity continuously.

API Key Security

store API keys in environment variables or a secrets manager

never commit API keys to version control

rotate keys regularly

never expose API keys in client-side code

never share API keys in tickets, email, or chat logs

Secure Backend Usage

.env

GENUKA_PAY_BASE_URL={{BASE_URL}}
GENUKA_PAY_PUBLIC_KEY=your_public_key
GENUKA_PAY_SECRET_KEY=your_secret_key

Webhook Verification

Always validate webhook signatures before processing the payload:

verify-webhook.ts

import crypto from "crypto";

export function verifyWebhook(signature, payload, secret) {
  const hmac = crypto
    .createHmac("sha256", secret)
    .update(JSON.stringify(payload))
    .digest("hex");

  return signature === hmac;
}

Data Protection

use HTTPS for all API calls

validate and sanitize all inputs

rate-limit sensitive endpoints

log API activity without exposing raw secrets

monitor suspicious operational patterns

Operational Recommendations

use a queue for webhook processing

rotate secrets on staff or infrastructure changes

keep production and testing secrets separate

mask phone numbers and sensitive references in logs when possible

review KYC and limits before enabling high-volume traffic

Design rule

Security for payment infrastructure is mostly about discipline: strict secret handling, trusted backend boundaries, and verifiable operational workflows.