Security

What we do to protect your integration, and what we ask you to do.

On our side

• API keys are 32 random characters after the prefix, shown once, and stored only as a keyed hash.
• Live keys are approved by a person before they work; live keys that can send money must have an IP allowlist.
• Creating or rolling a live key, and revealing or rolling a webhook secret, need the account's PIN, and its two-factor code when that is on.
• Webhooks are signed with a per-endpoint secret and carry a timestamp to stop replays.
• Every request is logged with masked bodies for 30 days, visible to you in the Console.
• We watch for unusual payout velocity, error spikes, refused calls and recipient sweeps, and can hold a payout, suspend a key, pause a payout method or suspend a workspace.
• Admin access on our side uses named accounts with two-factor sign-in, roles, an audit log, and two-person approval for raising limits and granting money-moving capabilities.

On yours

• Keep keys server-side, in a secret manager. Never in apps, browsers, repositories, logs or tickets.
• One key per service and environment, with the fewest scopes, and an IP allowlist of your servers' fixed addresses.
• Prefer 90-day keys and roll them on a schedule.
• Verify every webhook signature and timestamp; never trust an unsigned call to your webhook URL.
• Check recipients before first payouts, and cap what a single user of your product can trigger.
• Keep your workspace's technical, finance and security contacts current so our alerts reach someone.
• Turn on two-factor sign-in for every AutoPayKe account that can manage keys.

If something goes wrong

1. Revoke the affected key in the Console at once.
2. Roll the webhook secret if it may have leaked.
3. Review Logs for requests you didn't make (IP, time, path).
4. Email security@autopayke.com with your workspace id and the request ids.

To report a vulnerability in AutoPayKe, write to security@autopayke.com. Please don't test against other people's accounts or live money.