Cest

Cest security

Enforce trust at the integration boundary.

Use scoped credentials, server-side access checks, verified events, and bounded agent authorization.

Keep secret API keys on the server; use publishable keys for frontend initialization.

Verify webhook signatures against the raw request body before parsing.

Deduplicate webhook event IDs and use idempotency keys for usage consumption.

Configure mandate limits and revocation; use replay protection for paid endpoints.

Credentials and authentication Agent authorization Discuss your integration

Technical details and SDK names follow the linked ArcenPay documentation.