Security

The SDK handles authentication and security automatically.

Use Our SDKs

Always use our official SDK. It handles all security automatically, including request authentication and response verification.

import { createNylonPay } from '@nile-squad/nylonpay-ts';

const nylonPay = createNylonPay({
  apiKey: 'your_api_key',
  apiSecret: 'your_api_secret',
});

The same operations are available over HTTP from server to server: see REST API.

API Permissions (Send Only, Receive Only)

You can configure API keys to have limited permissions:

Configure this in Dashboard > API Keys when creating a new key.

Webhooks

We send webhooks to your server to push transaction status updates.

Always verify webhook signatures to confirm they are from us.

import { verifyWebhookSignature } from '@nile-squad/nylonpay-ts';

const isValid = verifyWebhookSignature({
  payload: rawBody,
  signature: signatureHeader,
  secret: webhookSecret,
});

if (!isValid) {
  res.status(401).end();
}

The standalone function takes a single VerifyWebhookInput. If you already have a client, nylonpay.verify_webhook_signature(payload=..., signature=..., secret=...) is the same check with keyword arguments.

verifyWebhookSignature also rejects replays. It checks the signed timestamp in the body is within a freshness window (default about 5 minutes), so a captured webhook cannot be re-sent later to re-trigger fulfilment. Tune it with toleranceSeconds. 0 means zero seconds of tolerance, the strictest setting. Pass DISABLE_FRESHNESS_CHECK to opt out (not recommended). See the Webhooks guide.

Polling - Check Transaction Status

Instead of waiting for webhooks, you can actively check transaction status using the SDK:

const result = await nylonPay.getStatus({
  reference: crypto.randomUUID(),
});

if (result.isOk) {
  console.log(result.value.status);
}

See Get Status for details.

IP Whitelisting

Restrict API access to only your server's IP addresses. Requests from any other IP will be rejected.

Configure this in:

Dashboard > API Keys > IP Restriction

For webhooks, you can whitelist our IP addresses. Contact support for the current IP list.

Data Encryption

All data is encrypted as it moves between your server and us.

This happens automatically.

Server Access Control

Only your server can talk to us.

Your API keys authenticate every request. Without valid keys, no one can access your account or send requests on your behalf.

Fraud and Velocity Protection

We run automated velocity, limit, and anomaly checks across live transactions. Unusual payouts may be held for review (on_hold) before funds leave your wallet.

What the SDK Handles Automatically

The SDK handles request signing and response verification automatically. Initialize the SDK with your API keys.

Dashboard Security Features

See Also

• Webhooks guide - signature verification details
• Get Status - polling transaction status
• Error Handling - handle errors gracefully