Skip to main content

General Error Codes


Batch Payout Error Codes

For detailed payout error handling, see Payout.

Funds Ledger Query Error Codes


QR Payment Error Codes


Web Payment Error Codes


Best Practices

Callback and Query Fallback Strategy

Use a “callbacks first, query as fallback” confirmation model for reliable order status management: Recommended approach:
  1. Rely on callbacks as the primary notification mechanism (see Notifications and Callbacks for integration details)
  2. Implement signature verification before processing any callback (see Authentication and Security)
  3. Use idempotency to handle duplicate callbacks safely
  4. Store notifications durably before processing
  5. Implement state-machine control for callback processing
Fallback Query Strategy: If callbacks are missing or delayed, use progressive backoff for status queries:
  • 5 seconds
  • 10 seconds
  • 30 seconds
  • 1 minute
  • 3 minutes
  • 5 minutes
This strategy prevents overwhelming the API while ensuring timely order confirmation.

Refund Confirmation

Refunds are asynchronous operations. A successful refund API response indicates only that the request has been accepted; it does not confirm the refund was actually processed. Required practice:
  • Confirm final refund results through the refund query API or refund callback (see Payments for refund callback details)
  • Use the “callbacks first, query as fallback” pattern to verify refund completion
  • Never consider a refund complete based solely on the API response

Security Best Practices

Authentication and Signature Verification
  • Always verify callback signatures before processing (see Authentication and Security)
  • Never return SUCCESS in a callback response if signature verification fails
  • Check the request timestamp to prevent replay attacks
Key Management
  • Do not expose server-side signing keys or credentials in client applications
  • Store merchant secrets securely using environment variables or secure vaults
  • Rotate signing keys periodically and maintain separate keys for test and production environments
Request Validation
  • Validate all request parameters before processing
  • Check Content-Type headers and ensure they match API requirements
  • Use HTTPS with TLS 1.2+ for all API communications