Developer docs

Integration security checklist

• Store API keys server-side only. Do not expose them in browser code, mobile apps, public repositories, or analytics events.
• Use idempotency keys for payment, payout, payment-link, and webhook registration mutations.
• Verify `nity0x-signature` on every webhook using the endpoint secret returned at registration time.
• Reject stale webhook timestamps and keep your own webhook handler idempotent.
• Do not treat dashboard navigation visibility as authorization; enforce permissions in server-side handlers.