TeePayDocs
Integration guides

Security

How to protect your keys, your customers and your webhook endpoint.

Your credentials

  • Keep API keys on your server, in a secret manager or environment variables. Never in browsers, mobile apps, chatbots or source control.
  • Give each key only the scopes it needs, and use separate keys per system.
  • Set an expiry, rotate regularly using the overlap window, and revoke immediately if a key may have leaked.
  • Use a link key for automation tools and AI agents: it can only create and read payment links.

Payments

  • Fulfil orders from server-side status (succeeded or paid), never from a browser redirect, a provider SMS or a 202.
  • Take amounts from your own database, not from the browser.
  • TeePay never asks for your customer's PIN, and you should never collect it.

Webhooks

  • Verify X-TeePay-Signature on the raw body and reject timestamps older than five minutes.
  • De-duplicate on X-TeePay-Event-ID.
  • Return 2xx only after you have stored the event.

What TeePay enforces

  • The account always comes from the credential; no request can act for another business.
  • Every request re-checks your account's verification, suspension and permissions.
  • Return and webhook URLs are configured only in the dashboard, never per API request.
  • Keys in query strings or alternative headers are rejected, so they never land in access logs.

Errors

The error format, every error code and how to handle each one.

MCP server

Let AI agents and chat automations create real TeePay checkout links and read verified payment status.

On this page

Your credentialsPaymentsWebhooksWhat TeePay enforces