Security
Security is the primary design constraint of Cartino Pay. This page summarises what the platform enforces and what your application must do.
What Cartino Pay enforces
| Area | Control |
|---|---|
| Transport | HTTPS only in production; HTTP callback URLs are rejected. |
| Application auth | Bearer tokens with 256-bit entropy; only SHA-256 hashes stored; constant-time lookup; revocable; optional expiry; multiple tokens per app for rotation. |
| Brute force | Failed authentications throttled per IP; per-application request rate limits. |
| Gateway credentials | Encrypted at rest (AES-256, APP_KEY); never serialised into API responses, logs or the payment trace; admins see only a masked tail. |
| Callback URLs | Strict allow-list per application (scheme + host + port + path). No open redirects. |
| Payment truth | Final status only from server-to-server verification. Browser callback parameters are used to locate a payment and are cross-checked against the stored gateway authority. |
| Amount integrity | Verification results carrying a different amount are rejected (never marked paid). |
| Concurrency | Verification is serialised per payment; status transitions are checked inside a row lock. No double-processing. |
| Idempotency | Idempotency-Key unique per application at the database level. |
| Webhooks | HMAC-SHA256 signatures over timestamp + body; per-application secret independent from the API token; rotation supported. |
| Test isolation | cp_test_ tokens can only use sandbox gateways; test payments are flagged. |
| Admin API | Separate hashed tokens, optional IP allowlist, separate rate limit, every mutation audit-logged. |
| Logging | Structured logs keyed by payment_id; tokens, secrets, merchant credentials and card numbers are redacted before persistence. |
| Data minimisation | No card data beyond a masked PAN returned by the gateway; no wallet or balance. |
What your application must do
- Keep the API token server-side. Never ship it to browsers or mobile apps.
- Verify every webhook signature and enforce the timestamp window. See Webhooks.
- Do not trust the callback query string for fulfilment. See Handling Callbacks.
- De-duplicate webhooks on
event_id. - Cross-check
amountandcurrencyin the webhook against your order before fulfilling. - Register precise callback URLs — one exact path, not a whole domain.
- Rotate secrets when staff with access leave or on suspected leak: ask an admin to issue a new token / rotate the webhook secret, deploy, then revoke the old one.
- Keep metadata free of secrets and sensitive personal data. It is stored and echoed back.
Reporting a security issue
Contact the Cartino platform team directly. Do not open a public ticket.