Payment Gateway Security Checklist for Merchants

A payment gateway can only be as secure as the way you use it. Most real-world losses come from small mistakes: a leaked key, a trusted redirect, an order credited twice. This checklist covers the protections built into ZurvaPay and the habits that keep your business safe.

1. Protect your API keys
2. Trust only signed notifications
3. Keep your domain locked
4. Never credit an order twice
5. Check the amount
6. One approved platform
7. Secure your account
8. Keep your KYC accurate
9. Monitor your payments
FAQ

1. Protect your API keys

Your public_key identifies your business, but your secret_key proves it. Keep the secret key on your server only. Never put it in JavaScript, a mobile app or a public repository. If you think a key has leaked, generate new keys at once; the old ones stop working immediately.

2. Trust only signed notifications

Verify both signatures of every IPN with your secret key before you touch an order. Never mark an order paid because a customer reached your success page. See the IPN guide for a working example.

3. Keep your domain locked

Your notification and return URLs must be on the website domain approved for your merchant account. This stops someone from using your keys with another site.

4. Never credit an order twice

Notifications can arrive more than once. Update the order with a single atomic statement, for example only where the status is still pending, and deliver the goods only when exactly one row was changed.

5. Check the amount

Confirm that the paid amount matches what the order was worth before you deliver. Never trust an amount sent from the customer's browser.

6. One approved platform

Your approval is tied to the platform you registered, a website, app or bot. Requests from anywhere else are blocked, which limits the damage even if your public key is copied.

7. Secure your account

Enable two-factor authentication.
Use a long, unique password.
Log out on shared computers.

8. Keep your KYC accurate

Accurate, verified details protect you in any dispute and keep withdrawals running smoothly. Identities linked to fraud are blacklisted and cannot register again, which keeps the network clean for honest merchants.

9. Monitor your payments

Review your transactions and pending payments regularly. Use the Check Payment Status page to look up any transaction ID, and add the optional cron job so your own orders are reconciled automatically.

Frequently asked questions

What should I do if my secret key leaks?

Generate new API keys from your dashboard immediately. The old keys stop working at once. Then update your server configuration.

Does ZurvaPay store card numbers on my server?

No. Customers pay on the hosted checkout, so payment details never touch your server.

Can someone fake a payment to my IPN URL?

They cannot pass signature verification without your secret key, which is why verifying both signatures is essential.

Build on a secure base

Open a ZurvaPay merchant account or contact us and we will help you get started.

Payment Gateway Security Checklist for Pakistani Merchants