Security
Practices for keeping your backend, keys, and payouts safe.
Checklist
- Test on testnet channels before sharing production URLs.
- Keep backend secrets in custom headers, never in public URL parameters.
- Never expose payment processor keys in client-side code or agent prompts.
- Set strict agent spend limits and alert on unexpected usage.
- Make sure your backend performs paid actions only on requests forwarded by AgentPay.
- Rotate keys and recipient addresses when ownership or access changes.