Security
KwikPaisa APIs are designed with enterprise-grade security standards to protect merchant transactions, sensitive customer data, and banking workflows.
All API requests are secured using HMAC SHA256 signature authentication, timestamp validation, encrypted communication, and strict request verification mechanisms.
This guide outlines the recommended security practices for securely integrating with KwikPaisa APIs.
API Authentication Security
Every API request must include:
Content-Type: application/json
Accept: application/json
X-API-KEY: pk_test_xxxxxxxxx
X-TIMESTAMP: GENERATED_TIMESTAMP
X-SIGNATURE: GENERATED_SIGNATUREThe X-SIGNATURE header is generated using:
HMAC_SHA256(payload + timestamp, secret_key)This helps prevent:
Unauthorized requests
Payload tampering
Replay attacks
Request forgery
Protect Your Secret Keys
Your secret_key is highly sensitive and should always remain confidential.
Best Practices
Never expose secret keys in frontend applications
Never commit credentials to Git repositories
Store secrets securely using environment variables
Rotate credentials periodically
Restrict internal access to production credentials
Always Use HTTPS
All API requests must be sent over secure HTTPS connections.
HTTPS encryption protects:
API credentials
Customer information
Transaction payloads
Webhook communications
Non-HTTPS requests may be rejected for security reasons.
Timestamp Validation
KwikPaisa validates request timestamps to prevent replay attacks.
Recommendations
Generate a fresh timestamp for every request
Use UNIX timestamp in seconds format
Synchronize server time using NTP
Avoid reusing old request payloads
Expired timestamps may result in:
Signature Verification
Before processing any request, KwikPaisa validates:
Payload integrity
Timestamp validity
Merchant authentication
Signature authenticity
Any mismatch between:
Request payload
Timestamp
Secret key
will invalidate the request.
Webhook Security
Webhook notifications should always be verified before processing.
Recommended Validation Steps
Validate webhook signature
Verify request timestamp
Check transaction status using APIs
Respond with HTTP 200 quickly
IP Whitelisting
For enhanced security, production merchants may enable IP whitelisting.
This allows API access only from trusted server IP addresses.
Benefits
Prevents unauthorized API access
Adds an additional security layer
Restricts access to approved infrastructure
Secure Server-Side Integrations
All:
Signature generation
Secret key handling
Transaction validation
must happen only on secure backend servers.
Never generate signatures from:
Mobile apps
Frontend JavaScript
Public client applications
Replay Attack Protection
KwikPaisa uses timestamp validation and request signing to prevent replay attacks.
Replay attacks occur when attackers reuse old valid API requests to trigger duplicate actions.
To prevent this:
Generate unique timestamps
Avoid duplicate order IDs
Validate transaction status before retries
Production Security Checklist
Before going live:
Use HTTPS only
Secure all secret keys
Validate webhook signatures
Enable IP whitelisting
Monitor API activity
Rotate credentials regularly
Implement proper server-side validation
Recommended Security Workflow
Generate timestamp
Prepare request payload
Generate HMAC SHA256 signature
Send secure HTTPS request
Validate API response
Verify webhook notifications
Common Security Errors
401 Unauthorized
Possible reasons:
Invalid signature
Expired timestamp
Incorrect secret key
Missing authentication headers
Invalid Signature
Usually caused by:
Modified payload
Incorrect JSON formatting
Unsorted payload keys
Timestamp mismatch
Need Help?
If you experience authentication or security-related issues, contact the KwikPaisa integration support team for assistance with:
Signature verification
Webhook validation
Production onboarding
IP whitelisting
Security configuration
Last updated