Security Best Practices
Protect your FiatPe API credentials and integration by following these recommended security practices across Test and Live environments.
Keep API credentials server-side
Never expose your API Key, Salt Key, or Authorization value in frontend applications, browser code, mobile app bundles, or public repositories.
Store credentials securely
Keep credentials in environment variables, a secrets manager, or another protected server-side configuration system instead of hardcoding them in source code.
Use separate environment credentials
Maintain separate credentials for Test and Live and ensure requests are sent only to the matching environment.
Do not log sensitive headers
Avoid logging full API keys, Salt Keys, Authorization headers, or other sensitive authentication values in application logs.
Use HTTPS for all requests
Send FiatPe API requests only over secure HTTPS connections to protect credentials and transaction data in transit.