In short
- Treat your API key like a password: keep it on your server, never in browser code or a public repository.
- Mark orders as paid only from a server-to-server notification whose signature you've verified - never from a redirect.
- Protect the way money leaves: verify payout addresses, review before sending, and watch for address-swapping malware and phishing.
Crypto payments are final, which is great for merchants - no chargebacks - but it also means mistakes and fraud are hard to undo. Most incidents don't involve breaking cryptography. They come from leaked keys, trusting the wrong signal, or sending funds to the wrong address. This checklist covers those.
1. Keep API keys on the server
- Store keys in environment variables or a secrets manager, not in source code. The OWASP Secrets Management Cheat Sheet is a good reference.
- Never put a secret key in JavaScript that runs in the browser or in a mobile app - anyone can extract it.
- Limit who can see the key. In CigalPay's merchant dashboard the API key is hidden until you choose to show it.
- If a key may have leaked, contact support right away to have it replaced, and review recent activity.
2. Trust only verified payment notifications
When a customer finishes paying, they're usually redirected back to your site. That redirect is a convenience, not proof of payment - anyone can open the URL. Mark an order paid only when your server receives a signed server-to-server notification (often called an IPN or webhook) and the signature checks out.
CigalPay sends payment notifications as a JSON POST to your notification URL, with an x-cigalpay-sig header containing an HMAC-SHA512 signature computed with your account's secret. Your endpoint should recompute the signature from the payload as described in the API documentation, compare the two using a constant-time comparison, and reject the request if they don't match.
- Use HTTPS for your notification endpoint.
- Make processing idempotent: the same status may be delivered more than once.
- Check that the amount and currency in the notification match the order before fulfilling it.
- Treat "confirming" as pending and ship only on a completed status - see payment finality.
3. Protect the way money leaves
- Copy, then verify. Clipboard-hijacking malware replaces a copied crypto address with the attacker's. After pasting a payout address, check the first and last several characters against the source.
- Check the network. A valid address on the wrong network can still lose funds - see wrong-network deposits.
- Use a review step. In CigalPay, payout requests show a confirmation screen with the full address and require you to confirm you've checked it; every request is then reviewed before funds move.
- Send a small test first to a new destination before moving a large amount.
- Watch forwarding changes. If payments are forwarded automatically to your wallet, a new address is confirmed with a code sent to your email and only used after 24 hours, and every change is emailed to you. Act on any change email you didn't expect.
- Don't take refund addresses from chat. A message asking you to refund to a new address may come from someone pretending to be the customer. CigalPay refunds send the customer their own link to enter it.
4. Secure your accounts
- Protect the email account that receives your login codes - with access to it, someone could sign in to your dashboard.
- Bookmark your dashboard URL and sign in only from the bookmark; phishing sites copy payment dashboards closely.
- Remove access for staff who leave, and give each person their own login rather than sharing one.
5. Harden your own integration
If you build on a payment API, the OWASP API Security Top 10 lists the most common weaknesses - broken authorization and excessive data exposure among them. A quick review against that list before launch catches most of them.
⚠️ Nobody legitimate will ask for your keys or login code. Support staff never need your API key, your login code or a verification code. Treat any request for them as an attack.
FAQ
Is the redirect after payment enough to confirm an order?
No. A redirect can be forged by anyone who knows the URL. Confirm orders only from a signed server-to-server notification that your server has verified.
What is an HMAC signature?
A code computed from the message and a shared secret. If someone changes the message or doesn't know the secret, the signature won't match - so your server can tell the notification is genuine.
What should I do if my API key leaks?
Contact support right away to have it replaced, update your server with the new key, and review recent payments and payout requests for anything unexpected.
Sources
- Secrets Management Cheat Sheet, OWASP
- OWASP Top 10 API Security Risks - 2023, OWASP
- Some things you need to know, Bitcoin.org
Originally published on the CigalPay blog. Disclosure: I'm part of the CigalPay team. Questions? Ask in the comments.
Top comments (0)