Security Best Practices

ClapPay is built with security from the ground up. Here's what we do:

Your secret API key is like a password. If someone gets it, they can use your account. Keep it safe:

Do

• Store keys in environment variables
• Keep secret keys on your server only
• Use different keys for test and production
• Rotate (change) keys every few months
• Use restricted keys when possible

Don't

• Put secret keys in JavaScript that runs in browsers
• Commit keys to Git or other version control
• Send keys in emails or chat
• Share keys with people outside your team
• Log keys in your application logs

Turn On Two-Factor Authentication (2FA)

2FA adds an extra step when logging in. Even if someone gets your password, they can't log in without your phone.

1. Go to Settings → Security
2. Click Enable 2FA
3. Scan the QR code with an authenticator app (Google Authenticator, Authy)
4. Enter the code to confirm

Use Strong Passwords

• At least 12 characters
• Mix of letters, numbers, and symbols
• Don't reuse passwords from other sites
• Use a password manager (like 1Password or Bitwarden)

Review Team Access

Regularly check who has access to your account:

• Remove people who no longer need access
• Give people only the permissions they need
• Use roles to limit what team members can do

Anyone can send fake webhooks to your server. Always verify that webhooks came from ClapPay:

Verify Signatures

Every webhook includes a signature. Check it before processing:

const sig = request.headers['clappay-signature'];
const endpointSecret = 'whsec_...';

try {
  const event = clappay.webhooks.constructEvent(
    request.body,
    sig,
    endpointSecret
  );
  // Safe to process
} catch (err) {
  // Invalid signature - reject!
  return response.status(400).send('Invalid signature');
}

Use ClapPay.js

Our JavaScript library (ClapPay.js) handles card data securely. Card numbers never touch your servers - they go straight to ClapPay.

Content Security Policy

Add ClapPay domains to your Content Security Policy (CSP):

Prevent Clickjacking

Make sure your payment pages can't be loaded in a malicious iframe:

PCI DSS is a set of rules for handling card data. When you use ClapPay correctly, you're already following most of them.

What ClapPay Handles

• Card number storage and encryption
• Secure transmission to card networks
• Tokenization of payment data
• Fraud monitoring

What You Need to Do

• Use our SDKs - don't build your own card forms
• Use HTTPS on your website
• Keep your systems updated
• Complete the SAQ (Self-Assessment Questionnaire) annually

Most ClapPay users only need to complete SAQ-A, the simplest form. We'll help you fill it out.

Keep an eye on your account for anything unusual:

• Check your API logs - Look for requests from unknown IPs or unusual patterns
• Review payments - Watch for test payments in live mode or strange amounts
• Set up alerts - Get notified for large transactions or many failed payments
• Check team activity - Review login history and changes made to settings

If you think your account was compromised:

1. Roll your API keys immediately - Dashboard → Settings → API Keys → Roll Key
2. Change your password - Use a new, strong password
3. Review recent activity - Check for unauthorized payments or refunds
4. Contact us - Our security team can help investigate
5. Check your code - Make sure you didn't expose keys accidentally