Your account
Security
Protect your account, your API keys and your webhook secrets: two-step verification, rolling and revoking keys, and what to do after a leak.
On this page
Three things open your AdProMaxPay account: the sign-in of each person on your team, your API keys, and the signing secrets of your webhook endpoints. This page says how to protect each one, and what to do when one may have leaked.
Your sign-in
- Use a strong password that you use nowhere else.
- Turn on two-step verification on your account's security page, with an authenticator app. It is optional in the sandbox, and we recommend it now: it will be required to work in live mode, and asked again for sensitive actions such as creating a live key or changing the team.
- Check your sessions. Your account's security page lists where you are signed in. Sign out a session you do not recognise, then change your password.
- AdProMaxPay staff never ask for your password, your verification codes or your secret keys. Do not give them to anyone who asks, whatever they say.
API keys
A secret key acts for your whole organization: whoever holds it can create payments, refunds and webhook endpoints in its mode. The kinds of key are described in Your API keys.
Keep them on your server
- Keep secret keys on your server, in an environment variable or a secret store. Never put one in a repository, a web page, a mobile app, a screenshot or a support ticket.
- Secret keys start with
apx_sk_, so secret scanners can recognise one that slipped into code. - Use one key per server or per use, and name it after its use ("Shop server", "Invoicing job"). You can hold 2 active secret keys and 2 publishable keys per mode by default; the Developers → API keys page shows how many you use.
- Each key shows when, and from which IP address, it was last used. A key used from an address you do not know is a warning sign. Developers → Request logs filters every request by key.
Roll a key
Roll replaces a key without downtime. You get a new key at once, shown this once, and choose how long the old one keeps working:
| Choice | The old key |
|---|---|
| Now | Stops at once. Use it when the key has leaked. |
| 1 hour | Works one more hour. |
| 24 hours | Works one more day. |
| 7 days | Works one more week, time to update every server that uses it. |
During that time the old key shows Rolling with a countdown, and it still counts against your key
limit. When the time is up, requests with it answer 401, api_key_expired. Install the new key
everywhere before then.
Revoke a key
Revoke stops a key at once and for good. Requests with it answer 401, api_key_revoked.
Revoke a key you no longer use: a key that exists can leak.
Live keys
Live keys exist once your account is active: see the go-live checklist. Treat them like the keys to your till.
Webhook signing secrets
Each webhook endpoint has its own signing secret, apx_whsec_…, shown once when you create the
endpoint. Your server uses it to verify each delivery.
- Verify every delivery, and refuse one whose timestamp is more than five minutes away from your clock.
- Endpoints use
httpsonly. A private or local address is refused. - Show the secret again on the endpoint's settings page in the dashboard, under Developers → Webhooks. Each time it is shown, it is recorded.
- Roll the secret on the same page if it may have leaked, or as a habit. You choose how long the old secret keeps signing: not at all, one hour or 24 hours. Meanwhile each delivery carries two signatures, one per secret, so your old and new configuration both accept it.
Roles
- Give each person the smallest role that does their job: a support agent needs Support, not Administrator. The roles are described in Team and roles.
- Review your team from time to time on Settings → Team.
- When someone leaves, remove them, then roll the keys and webhook secrets they could see.
- Your organization has one Owner. Ownership can be transferred to another member.
If a key may have leaked
- Roll the key with Now, or revoke it. Your servers need the new key at once.
- Read Developers → Request logs for that key: look for requests you did not send.
- Check for payments, refunds or webhook endpoints that you did not create, in the same mode.
- If the key reached a repository, remove it from the repository's history as well: rolling the key already made the leaked copy useless.
Do the same for a webhook secret: roll it, then check the endpoint's deliveries.
What AdProMaxPay does on its side
- Card numbers never travel through the API. Card details are typed on a secure payment page, never on yours; a value that looks like a card number is refused anywhere in a request.
- Request logs mask secrets. Keys, webhook secrets, passwords and card-like numbers are hidden in the request logs of the dashboard.
- Secret keys are stored as a keyed hash. A secret key cannot be shown again after its creation, by you or by us: when one is lost, create or roll a key.