Security

All requests are HMAC-SHA256 signed

Timestamp validation (±5 min window)

Replay protection (a signature cannot be reused)

HTTPS required — HTTP is rejected

Store the API key and secret server-side

Always verify the callback signature