DevelopersVirtual AccountSecurity Checklist

Security Checklist

Before going live, ensure your integration satisfies all of the following requirements.

Full Checklist

✅
Keys
Store your secretKey in a server-side environment variable. Never expose it in frontend code or public repositories.
✅
Keys
Keep your Staging and Production API keys completely separate. Never use one environment's keys in the other.
✅
Keys
Rotate your secretKey by contacting KongaPay support if you suspect it has been compromised.
✅
Webhooks
Validate all incoming webhook payloads by verifying the callback signature before processing.
✅
Webhooks
Use session_id as a deduplication key to prevent processing the same payment event twice.
✅
Network
Whitelist KongaPay's IP ranges on your callback endpoint to reject unauthorised POST requests.
✅
Audit
Log all virtual account transactions and callback events for audit trail and dispute resolution.
✅
Audit
Run daily reconciliation jobs to catch any transactions not confirmed via callback.

Keys3 items

✓Store your secretKey in a server-side environment variable. Never expose it in frontend code or public repositories.
✓Keep your Staging and Production API keys completely separate. Never use one environment's keys in the other.
✓Rotate your secretKey by contacting KongaPay support if you suspect it has been compromised.

Webhooks2 items

✓Validate all incoming webhook payloads by verifying the callback signature before processing.
✓Use session_id as a deduplication key to prevent processing the same payment event twice.

Network1 items

✓Whitelist KongaPay's IP ranges on your callback endpoint to reject unauthorised POST requests.

Audit2 items

✓Log all virtual account transactions and callback events for audit trail and dispute resolution.
✓Run daily reconciliation jobs to catch any transactions not confirmed via callback.

Ready to Go Live?

Create your Production account to start accepting real payments.

After registering, contact the KongaPay support team to receive your Production API keys.