Access

Security

Live keys move real TZS. A merchant collects and pays out after the account is active. The owner portal and the merchant portal are separate permission domains.

How access is held

• Passwords are stored with Argon2id. Ten wrong portal passwords in 15 minutes stay on the same response, and the account stays locked for that window.
• API keys are stored hashed. The full secret is shown once, in the merchant portal, and sent as Authorization: Bearer.
• Portal sessions use an HTTP-only cookie and a double-submit CSRF token. Sign-in can require a one-time code by SMS.
• Webhooks are HMAC-signed over the raw body. A timestamp more than five minutes off is rejected. Retries keep the same event id.
• Money and access actions are written to an insert-only audit log.

Before money moves

A new merchant starts waiting for verification. Collections and payouts stay closed until the account is active. Identity documents are reviewed in the owner portal. Rejecting a submission sends the reason back to the merchant.

Keys

A secret key is created in Developers and shown once. After that, AFRIPEI stores only a hash. Send the key as Authorization: Bearer. A key that can collect is not automatically a key that can pay out. Each action has its own scope. Revoking a key stops it immediately.

A publishable key can open a checkout page. It cannot list payments, create payouts, or read the balance.

Sessions

The merchant portal and the owner portal do not share a session. Signing in can require a one-time code by SMS. The session cookie is HTTP-only. A second cookie carries the CSRF token that state-changing requests must send back. Ten wrong passwords in 15 minutes keep the same error and leave the account locked for that window.

Webhooks

Each delivery is signed over the raw body with the endpoint secret. A timestamp more than five minutes off is rejected. Retries keep the same event id, so your handler can ignore a delivery it has already applied. Rotate the secret from the portal when someone who should not have it has seen it.

What is written down

Money and access actions are written to an insert-only audit log. Fee snapshots and ledger lines are not edited to tidy a screen. If a payout fails, the reservation is released and the reason stays on the payout.