Skip to main content
This page covers what you need to get right in your own integration. For certifications, encryption, infrastructure, data residency, retention, and contractual commitments, see the SmartRetry security page.

​
Card data

SmartRetry does not store card numbers. For repeat billing, send a stored payment token instead of raw card details - see Payment methods.
Because SmartRetry transmits cardholder data on your behalf, your own PCI DSS obligations still apply to how you collect and send that data. Using tokenized flows reduces the scope you have to cover.

​
API keys

API keys authenticate server-to-server requests only. Never expose a key client-side, keep keys out of source control, and use separate keys per environment. See Authentication for handling and rotation.
If you believe your API key has been exposed, contact security@smartretry.com immediately so it can be revoked and replaced.

​
Webhooks

Your webhook endpoint is a public URL - anyone can post to it. Verify the signature on every incoming payload before acting on it, and reject anything that fails. Treat delivery as at-least-once and key your processing on the event ID. See Webhooks for the signature scheme and verification examples.

​
Transport

TLS 1.3 is negotiated by default and TLS 1.2 is the enforced minimum. Do not disable certificate verification in your HTTP client, including in staging.

Authentication

API key handling, rotation, and best practices.

Webhooks

Verify webhook signatures before trusting a payload.

Rate limiting

Request limits and how to handle throttling.