Security
Security notes
How this GressPay instance authenticates and signs events
API secrets
Live keys start with gp_live_. Test keys start with gp_test_. Only a prefix is shown after creation. The full secret is stored hashed. Rotate from Dashboard → API Keys.
Dashboard sessions
Merchant login issues a JWT. The dashboard sends it as Bearer and, when you switch Live / Test, adds X-GressPay-Mode.
Webhooks
Paid events POST JSON to your URL with X-GressPay-Signature = HMAC-SHA256 of the raw body using your webhook secret. Verify before you fulfill an order.
What we do not store
No card PANs, CVVs, or 3-D Secure payloads. Checkout collects customer name / contact and a transaction ID for the rail you enabled.