Credentials stay private
Server-side API credentials authenticate your integration. Secret keys must never appear in customer pages, public repositories or browser JavaScript.
Flux Pay / SECURITY & CONTROLSECURITY & CONTROL
Careful controls. Clear responsibilities.
Understand the approach to account access, private credentials and verified payment status.
Verify the payment
Treat a server-verified payment status as authoritative. Browser redirects and screenshots are not payment confirmation.
Separate account access
Merchant and owner consoles use separate account access. Account permissions determine which operations a merchant can perform.
Protect the whole payment journey.
Use a strong unique password, restrict who can access live credentials and keep settlement destinations accurate. Validate webhook signatures, handle repeated events safely and investigate uncertain payment or payout requests before retrying.
For a suspected account issue, contact support with a non-sensitive reference and a short description. Never include a password, API secret or wallet PIN.
Open merchant support