Skip to content
MojoPay Omni OMNI Payments API

Payments API

Security baseline

  • HTTPS only for API and webhook URLs. The merchant portal rejects webhook targets that use private/reserved addresses, localhost, or embedded credentials; outbound delivery also skips targets that fail the same checks (including DNS resolution to a non-public IP when enabled).
  • Optional API IP allowlist (portal → Developers → API security, Portal admin only, or admin merchant edit): when configured, POST /v1/oauth/token and all bearer-authenticated routes are rejected unless the client IP matches an allowed IPv4/IPv6 address or CIDR. Empty allowlist means no IP restriction. Behind a reverse proxy, set TRUSTED_PROXIES so the application sees the real client IP.
  • Tenant isolation — Bearer tokens are scoped to one merchant. Lookups by public ID or merchant_reference never return another merchant’s records (missing resources respond 404).
  • OAuth — Invalid or unknown client_id values still run secret verification against a fixed hash to reduce timing leaks; per-IP and per-client rate limits apply to POST /v1/oauth/token.
  • Never send client_secret / access_token in query strings or redirect URLs.
  • Verify every outbound webhook from MojoPay using MojoPay-Signature before changing state (see Verify webhook signatures).
  • Use constant-time signature comparison (hash_equals, timingSafeEqual).
  • Hosted checkout offers mobile money on the pay page, plus card only when MojoPay has enabled card checkout for your merchant.