- Use a production HTTPS webhook that responds within 10 seconds.
- Keep API credentials in a server-side secret manager.
- Generate unique transaction IDs and enforce idempotency locally.
- Store all create responses before redirecting users or acknowledging requests.
- Reconcile webhook events with status polling.
- Validate amount limits before sending requests.
- Retain transaction and evidence logs according to your compliance policy.
- Test pending, success, failed, duplicate, and missing-webhook paths.
Payment correctness#
- Distinguish API acceptance from final payment success.
- Fulfill each order once, even when callbacks repeat.
- Treat unknown payout outcomes as unresolved rather than creating replacement transfers.
- Keep INR and USDT accounting separate.
- Treat sample fees, IDs, and beneficiary data as examples only.
Evidence and callbacks#
- Handle masked or unreadable screenshots without declaring them successful.
- Keep the raw webhook body available for signature verification.
- Reject invalid signatures and stale timestamps.
- Maintain status reconciliation when notifications are delayed.
Support handoff#
Include transaction identifiers, UTC timestamps, the endpoint, HTTP status, and sanitized response details when reporting an issue. Never share your API key.