Reference

Security

Best practices for securing your CamelPay integration. API key security, webhook verification, and input validation.

API Key Security

Do

Store keys in environment variables or secret managers
Use test keys for development, live keys for production
Rotate keys periodically (every 90 days recommended)
Use minimum required scopes
Revoke compromised keys immediately

Don't

Never commit keys to version control
Never expose keys in client-side code
Never share keys across applications
Never log full API keys
Never use live keys in development

Environment Variables

bash

# .env file (NEVER commit this)
CAMELPAY_API_KEY=cp_live_your_production_key_here
CAMELPAY_WEBHOOK_SECRET=your_webhook_secret_here

HTTPS Enforcement

All production API calls must use HTTPS:

✅ https://api.camelpay.in/payments/checkout
❌ http://api.camelpay.in/payments/checkout

Input Validation

Always validate customer input on your server:

python

import re

def validate_phone(phone):
    """Validate E.164 phone format."""
    pattern = r'^\+[1-9]\d{1,14}$'
    return re.match(pattern, phone) is not None

def validate_amount(amount, min_amount=500):
    """Validate payment amount."""
    return isinstance(amount, int) and amount >= min_amount

Logging Security

python

# DO log
logger.info("Payment initiated", {
    "reference": reference,
    "amount": amount,
    "status": status
})

# DON'T log
logger.info("API key used: cp_live_actual_key_here")  # NEVER!