Skip to main content

​
Security

Elite Neo Bank APIs are designed with enterprise-grade security standards to protect merchant transactions, sensitive customer data, and banking workflows. All API requests are secured using HMAC SHA256 signature authentication, timestamp validation, encrypted communication, and strict request verification mechanisms. This guide outlines the recommended security practices for securely integrating with Elite Neo Bank APIs.

​
API Authentication Security

Every API request must include:
The X-SIGNATURE header is generated using:
This helps prevent:
  • Unauthorized requests
  • Payload tampering
  • Replay attacks
  • Request forgery

​
Protect Your Secret Keys

Your secret_key is highly sensitive and should always remain confidential.

​
Best Practices

  • Never expose secret keys in frontend applications
  • Never commit credentials to Git repositories
  • Store secrets securely using environment variables
  • Rotate credentials periodically
  • Restrict internal access to production credentials

​
Always Use HTTPS

All API requests must be sent over secure HTTPS connections. HTTPS encryption protects:
  • API credentials
  • Customer information
  • Transaction payloads
  • Webhook communications
Non-HTTPS requests may be rejected for security reasons.

​
Timestamp Validation

Elite Neo Bank validates request timestamps to prevent replay attacks.

​
Recommendations

  • Generate a fresh timestamp for every request
  • Use UNIX timestamp in seconds format
  • Synchronize server time using NTP
  • Avoid reusing old request payloads
Expired timestamps may result in:

​
Signature Verification

Before processing any request, Elite Neo Bank validates:
  • Payload integrity
  • Timestamp validity
  • Merchant authentication
  • Signature authenticity
Any mismatch between:
  • Request payload
  • Timestamp
  • Secret key
will invalidate the request.

​
Webhook Security

Webhook notifications should always be verified before processing.
  1. Validate webhook signature
  2. Verify request timestamp
  3. Check transaction status using APIs
  4. Respond with HTTP 200 quickly

​
IP Whitelisting

For enhanced security, production merchants may enable IP whitelisting. This allows API access only from trusted server IP addresses.

​
Benefits

  • Prevents unauthorized API access
  • Adds an additional security layer
  • Restricts access to approved infrastructure

​
Secure Server-Side Integrations

All:
  • Signature generation
  • Secret key handling
  • Transaction validation
must happen only on secure backend servers. Never generate signatures from:
  • Mobile apps
  • Frontend JavaScript
  • Public client applications

​
Replay Attack Protection

Elite Neo Bank uses timestamp validation and request signing to prevent replay attacks. Replay attacks occur when attackers reuse old valid API requests to trigger duplicate actions. To prevent this:
  • Generate unique timestamps
  • Avoid duplicate order IDs
  • Validate transaction status before retries

​
Production Security Checklist

Before going live:
  • Use HTTPS only
  • Secure all secret keys
  • Validate webhook signatures
  • Enable IP whitelisting
  • Monitor API activity
  • Rotate credentials regularly
  • Implement proper server-side validation
  1. Generate timestamp
  2. Prepare request payload
  3. Generate HMAC SHA256 signature
  4. Send secure HTTPS request
  5. Validate API response
  6. Verify webhook notifications

​
Common Security Errors

​
401 Unauthorized

Possible reasons:
  • Invalid signature
  • Expired timestamp
  • Incorrect secret key
  • Missing authentication headers

​
Invalid Signature

Usually caused by:
  • Modified payload
  • Incorrect JSON formatting
  • Unsorted payload keys
  • Timestamp mismatch

​
Need Help?

If you experience authentication or security-related issues, contact the Elite Neo Bank integration support team for assistance with:
  • Signature verification
  • Webhook validation
  • Production onboarding
  • IP whitelisting
  • Security configuration