Skip to main content

Environments

Payfonte provides two environments for integration:
Do not use live provider credentials in sandbox. Keep sandbox and production credentials separate.

API Authentication

All API calls require these headers:
  • client-id
  • client-secret
You can find both in: Dashboard -> Settings -> Security -> API Keys and Webhooks

Sandbox Example

Production Go-Live Checklist

1

Complete testing in sandbox

Validate successful, failed, and pending flows, including webhooks.
2

Complete KYB onboarding

Submit your business details using the KYB onboarding form.
3

Switch credentials and base URL

Replace sandbox client-id/client-secret with production keys and update your API base URL to https://api.payfonte.com.
4

Verify webhooks in production

Confirm your production webhook URL is configured under Settings -> Security -> API Keys and Webhooks.
Use environment variables so secrets stay out of source code:

Security Notes

  • Never expose client-secret in frontend apps.
  • Never commit credentials to git.
  • Rotate keys immediately if you suspect exposure.
  • Use HTTPS for API and webhook endpoints.