• Keep API keys, webhook secrets, and integration credentials in a managed secret store.
  • Use HTTPS for every production endpoint.
  • Allowlist website origins and return URLs.
  • Never log client tokens, API keys, webhook secrets, raw card numbers, security codes, or expiry data.
  • Keep payment fields on Zahlo-hosted or embedded secure surfaces.
  • Verify webhook signatures against the raw request body before parsing or processing.
  • Limit metadata to non-sensitive identifiers; do not put personal data or secrets in metadata.
  • Redact request and response bodies in error reporting where they may contain customer data.
  • Restrict dashboard roles and rotate credentials after personnel or system changes.

​
Browser boundary

Expose only a session ID and short-lived client token to the browser. The token must be scoped to the session and must not be placed in a query string, referrer, analytics event, or local-storage record. For in-page checkout, allowlist the exact origin and keep sensitive fields inside the secure component.

​
Webhook boundary

Verify the raw body and replay protection before parsing or enqueueing. Return a success response only after authenticity and schema checks pass. Keep the handler idempotent and use a durable queue for slow fulfillment, email, inventory, or entitlement work.