Security and data

Keys and secrets

• API keys and webhook signing secrets are shown once and cannot be recovered. Store them in a secret manager, never in a frontend, an app bundle, or source control.
• Only a keyed hash of each API key is stored; signing secrets are stored encrypted.
• Roll a key or secret if it may have been exposed, and revoke the old one.

What the API never returns

Dispute statements, evidence, reasons, or arbiter notes, and any other business’s data. Webhook events also leave out your metadata and merchant reference.

Retention

The Events API returns events from the last 30 days. Intents and payments stay readable through their endpoints. Keep your own copy of anything you need longer.