Security
Security standards for holding credentials, API secret management, CSRF defense, PCI DSS compliance scope, and key revocation.
API Secret Management & Storage
When you create a Gateway API Key via POST/developer/gatewayConfigs, the apiSecret is returned only once in plaintext. Ziba Pay stores only a one-way cryptographic hash of this secret.
Because the plaintext secret cannot be recovered or displayed again, immediately copy and store it in an encrypted secret management vault (e.g. AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) or protected server environment variables.
Authentication & CSRF Protection
Ziba Pay supports both header-based token authentication and session cookie authentication with strict CSRF safeguards:
- Preferred: Authorization: Bearer <token> or x-api-key and x-api-secret headers for all automated server-to-server calls.
- Cookie Authentication: If your application sends the
auth_tokencookie on state-changing requests (POST, PATCH, DELETE), you must also supply the header X-Requested-With: XMLHttpRequest. Requests using cookies without this header are rejected with HTTP 403 to prevent Cross-Site Request Forgery (CSRF).
Card Data Security & PCI DSS Scope
Ziba Pay delegates card processing directly to TransactPay, an audited PCI-DSS Level 1 compliant payments service provider.
To maintain PCI DSS compliance within your own infrastructure:
- Transmit card details exclusively from your secure backend servers to Ziba Pay over TLS 1.2+ encrypted channels.
- Never store primary account numbers (PANs), card security codes (CVVs), or card PINs on your servers, hard drives, or log files.
- For recurring card billing, utilize the tokenization endpoint POST/payment/zibapay/order/save-card/:reference to store card tokens rather than raw card credentials.
Rate Limiting & Abuse Defense
To protect payment infrastructure against brute-force and denial-of-service attempts, strict rate limits are enforced at the network edge:
| Route Scope | Rate Limit Window | Action on Limit Exceeded |
|---|---|---|
Payment Routes (/payment/*) | 15 requests per minute per IP | HTTP 429 Too Many Requests |
| Global API Surface | 300 requests per 15 minutes per IP | HTTP 429 Too Many Requests |
Key Revocation & Incident Response
If an API key is accidentally leaked or compromised, revoke it immediately via DELETE/developer/delete/:id. Revocation takes effect instantaneously across all cluster nodes, and subsequent calls using the compromised key will fail with HTTP 401 Unauthorized.
curl -X DELETE "https://payment-service-mh2d.onrender.com/api/developer/delete/gwcfg_9f8e7d6c5b4a" \
-H "Authorization: Bearer <merchant_token>"