Security best practices and authentication methods for integrating with MarzPay.

​
Authentication

MarzPay uses API key authentication. Every request must include your secret key in the Authorization header:

​
API key management

Public Key

Used on the frontend to initialize payment sessions. Safe to expose.

FrontendSafe to expose

Secret Key

Used on your backend to authenticate API requests. Never expose.

Backend onlyNever expose

​
Security best practices

1

Never expose your secret key

Store your secret key in environment variables on your server. Never commit it to version control or include it in frontend code.
2

Use HTTPS

All API calls must use HTTPS. Never send API keys over HTTP.
3

Verify webhook signatures

Always verify webhook signatures before processing events. See the Webhooks page for details.
4

Implement idempotency

Use unique reference IDs for each transaction to prevent duplicate processing.
5

Rotate keys regularly

Rotate your API keys periodically and immediately if you suspect a compromise.

​
Idempotency

Include a unique reference field in each request to prevent duplicate processing:
If you retry a request with the same reference, MarzPay returns the original response instead of creating a duplicate transaction.

​
Rate limiting

If you exceed the rate limit, you will receive a 429 Too Many Requests response. Implement exponential backoff.

​
PCI-DSS compliance

If you handle raw card data (card number, CVV, expiry), you must be PCI-DSS compliant. To reduce compliance scope, use the redirect URL method for card payments instead of direct API integration.

​
IP allowlisting

Production accounts can request IP allowlisting in the Dashboard. This restricts API access to your specified IP addresses.
API Playground - Security - Test security-related endpoints live