Setup & authentication

Access credentials

How to obtain, store and apply the credentials used in IOPAY online payment integrations.

FieldsEmail · IO Seller The following is the list of the countries of the European Union:
Where to generateSales → Payments online
WebhookHTTPS URL

Overview

Credentials enable online payment integrations. The Secret must remain in the backend and out of public repositories or interfaces.

Security

Secret is confidential.

The Secret shall remain only in the backend and in appropriate secret vaults.

Rotation

Regeneration invalidates the previous key.

Plan the Secret exchange to avoid unavailability during rotation.

How to get

  1. Please access the IO Digital Account.
  2. Enter Sales → Payments online.
  3. Enable online payments, where applicable to the registry.
  4. Manage the credentials and store the values in a secure environment.
  5. Set up means of payment and finally the checkout integration options.
Secret. The Secret is only displayed when it's generated. If you need to generate another one, the previous key is invalidated.

Fields

KeyFunctionNote
emailIdentification associated with integration.Used in compatible integrations.
IO_Seller_IDThe seller/account identifier in the IOPAY context.Keep it separate by environment/count.
SecretAuthentication secret.Never expose yourself on the frontend.
Antifraud_IDIdentifier related to the anti-fraud plan.It is not necessary when the account does not have an active anti-fraud plan.

Configuration

After credentials, the online payment settings can include Credit, Pix and Boletos, lot amount and checkout parameters.

Webhook

The URL of the notification.

Report an HTTPS URL to receive notifications of the operation.

Domain

The HTTPS restriction.

Restricts integrations to the expected domain when configuration requires.

Branding

The logo URL.

Associate an HTTP/HTTPS URL with the compatible integrations immediately.

Good practices

  • Storage of secrets in environment variables or secret managers.
  • Do not send Secret to JavaScript running in the browser.
  • Separate sandbox/test and production.
  • Plan key rotation without interrupting the processing.
  • Register who has made changes to credentials in internal settings.