> ## Documentation Index
> Fetch the complete documentation index at: https://www.smartretry.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing your integration

> Handling API keys, verifying webhooks, and keeping card data out of your scope.

This page covers what you need to get right in your own integration. For certifications, encryption, infrastructure, data residency, retention, and contractual commitments, see the [SmartRetry security page](https://www.smartretry.com/security).

## Card data

SmartRetry does not store card numbers. For repeat billing, send a stored payment token instead of raw card details - see [Payment methods](/docs/docs/integration/payment-methods).

<Note>
  Because SmartRetry transmits cardholder data on your behalf, your own PCI DSS obligations still apply to how you collect and send that data. Using tokenized flows reduces the scope you have to cover.
</Note>

## API keys

API keys authenticate server-to-server requests only. Never expose a key client-side, keep keys out of source control, and use separate keys per environment. See [Authentication](/docs/docs/authentication) for handling and rotation.

<Warning>
  If you believe your API key has been exposed, contact [security@smartretry.com](mailto:security@smartretry.com) immediately so it can be revoked and replaced.
</Warning>

## Webhooks

Your webhook endpoint is a public URL - anyone can post to it. Verify the signature on every incoming payload before acting on it, and reject anything that fails. Treat delivery as at-least-once and key your processing on the event ID. See [Webhooks](/docs/docs/integration/webhooks) for the signature scheme and verification examples.

## Transport

TLS 1.3 is negotiated by default and TLS 1.2 is the enforced minimum. Do not disable certificate verification in your HTTP client, including in staging.

<CardGroup cols={3}>
  <Card title="Authentication" icon="key" href="/docs/docs/authentication">
    API key handling, rotation, and best practices.
  </Card>

  <Card title="Webhooks" icon="webhook" href="/docs/docs/integration/webhooks">
    Verify webhook signatures before trusting a payload.
  </Card>

  <Card title="Rate limiting" icon="gauge" href="/docs/docs/api-reference/rate-limiting">
    Request limits and how to handle throttling.
  </Card>
</CardGroup>