Skip to main content

​
Security checks

Elite Neo Bank recommends implementing multiple security layers before enabling production payment and payout processing. Security checks help protect:
  • Merchant accounts
  • Customer transactions
  • Banking infrastructure
  • API credentials
  • Payout systems
  • Webhook endpoints
Production financial systems should always follow strict security and compliance standards.

​
Core Security Requirements

All merchants should implement:
  • HTTPS-only communication
  • HMAC SHA256 signature verification
  • Secure credential storage
  • Webhook signature validation
  • Replay attack protection
  • Server-side transaction validation
  • Transaction monitoring

​
API Authentication Security

Every API request must include valid authentication headers:
Elite Neo Bank validates:
  • Merchant authentication
  • Request integrity
  • Timestamp freshness
  • Payload authenticity
Invalid or tampered requests are rejected automatically.

​
Signature Verification

All requests should use HMAC SHA256 signatures. Signature verification protects against:
  • Payload tampering
  • Unauthorized API access
  • Replay attacks
  • Forged transaction requests
Recommended formula: Refer to:
➡️ Authentication → Signature

​
Timestamp Validation

Timestamps help prevent replay attacks. Merchants should:
  • Generate fresh timestamps for every request
  • Use UNIX timestamps in seconds
  • Synchronize server time properly
  • Reject expired requests

​
Secret Key Protection

Your secret_key is highly sensitive. Never:
  • Expose secret keys publicly
  • Store credentials in frontend applications
  • Commit credentials to Git repositories
  • Share production keys insecurely
Recommended storage:
  • Environment variables
  • Secure secret managers
  • Encrypted infrastructure storage

​
HTTPS Enforcement

All APIs and webhook endpoints must use HTTPS. HTTPS protects:
  • Transaction payloads
  • API credentials
  • Customer data
  • Banking communication
Non-HTTPS integrations may be blocked in production environments.

​
Webhook Security

Webhook endpoints should always:
  • Verify webhook signatures
  • Validate timestamps
  • Handle duplicate events safely
  • Return HTTP 200 quickly
  • Process requests asynchronously
Never trust webhook payloads without verification.

​
Replay Attack Protection

Replay attacks occur when attackers reuse previously valid requests. To prevent replay attacks:
  • Validate timestamps
  • Reject old requests
  • Generate unique transaction IDs
  • Use idempotent processing
  • Verify signatures properly

​
IP Whitelisting

Production merchants are strongly encouraged to enable:
  • Static IP whitelisting
  • Geo-restricted payout access
  • Secure backend-only API access
Only trusted backend infrastructure should access production APIs.

​
Transaction Validation

Before processing transactions:
  • Verify payment status using APIs
  • Validate payout status server-side
  • Check webhook authenticity
  • Confirm transaction references
  • Prevent duplicate transaction handling

​
Logging & Monitoring

Merchants should securely monitor:
  • Failed authentication attempts
  • Invalid signature requests
  • Webhook failures
  • Duplicate transaction attempts
  • Suspicious payout activity
  • API error spikes
Maintain secure audit logs for:
  • Compliance
  • Reconciliation
  • Security investigations
Elite Neo Bank recommends:

​
Common Security Risks

Avoid:
  • Exposing production credentials
  • Using frontend signature generation
  • Ignoring webhook verification
  • Blind retry loops
  • Sharing API keys publicly
  • Running production APIs from unsecured servers

​
Infrastructure Recommendations

Production systems should use:
  • Dedicated backend infrastructure
  • Static public IPs
  • Secure firewall rules
  • VPN-restricted administrative access
  • Encrypted storage systems
  • Monitoring and alerting tools

​
Operational Security Recommendations

Merchants should:
  • Rotate credentials periodically
  • Restrict internal API access
  • Maintain access logs
  • Review payout activities regularly
  • Monitor webhook failures continuously

​
Compliance Recommendations

Depending on merchant category and geography, merchants may be required to:
  • Maintain transaction logs
  • Store reconciliation records
  • Follow banking compliance rules
  • Enable audit tracking
  • Support dispute investigations

​
Best Practices

  • Validate every transaction server-side
  • Use unique transaction references
  • Implement retry-safe workflows
  • Handle webhooks asynchronously
  • Monitor production systems continuously
  • Test security controls regularly

​
Important Notes

  • Production APIs process real financial transactions
  • Banking security controls may vary by region
  • Payout systems may have additional compliance requirements
  • Security validation should be reviewed periodically

​
Final Production Security Checklist

Before going live: ✅ HTTPS enabled
✅ Signatures verified
✅ Webhook validation implemented
✅ Retry protection configured
✅ IP whitelisting enabled
✅ Audit logging configured
✅ Monitoring systems active
✅ Credentials secured

​
Need Help?

For production security reviews, IP whitelisting, payout compliance, or advanced infrastructure security assistance, contact the Elite Neo Bank onboarding and integration team.