Developer Settings
Merchant Back Office
Developer Settings
Developers set up core credentials and security configurations required to manage merchants' access to the PayCools API, including AppID, webhook callback address, API Key (merchant public key), and IP whitelist. These parameters are the basis for interface calls, signature verification, callback reception, and access control.
1
Configure Portal
Log in to the merchant backend to access the developer settings page via the following path:
Developer Settings → App Details
On the app details page, you can view and edit configuration items such as AppID, Webhook, API Key, and IP whitelist.
2
Field description
| Field | Description |
|---|---|
| Unified configuration switch | After turning it on (it is turned on by default), the webhooks, API Keys and other information configured under the current country will be automatically synchronized to other countries to achieve "one-time configuration, multi-country validation"; after closing, the country configurations are independent of each other. |
| AppID | Unique identifier of the app, used to identify the merchant in the API request, which needs to be carried when calling the interface. |
| Webhook | Payment result callback notification address (Notify URL).When the payment transaction status changes, the platform will asynchronously push notifications to the address, and the merchant should update the order status accordingly. The address must be HTTPS and support post requests. The platform will sign the notification message. Merchants need to use the platform public key to verify the signature. |
| API Key (Public Key) | The RSA public key (2048 bits) uploaded by the merchant to the platform. The platform uses this public key to verify the signature of the merchant's request, and the merchant uses the private key paired with it to sign the request. See Technical parameter configuration. |
| IP whitelist | The IP address of the server that is allowed to initiate API requests. Only the IP in the whitelist can successfully call the interface, and unwhitewashed requests will be rejected; single IP and CIDR segments are supported, and multiple lines are separated by line breaks. To make adjustments, contact the PayCools team. The test environment does not verify the IP whitelist. |
3
Configuration Considerations
- Key Security: Merchant private keys should be kept safe and never exposed on the front end or submitted to the code repository. Once compromised, regenerate the key pair and update the background public key configuration immediately.
- Public Key Update: After updating the public key, the platform will use the new public key to verify the signature of subsequent requests. Please ensure that the server switches to the corresponding private key signature synchronously to avoid signature verification failures.
- Webhook security: The callback address must be the HTTPS protocol; after receiving the notification, the platform public key should be used to verify the signature, and then the business logic should be processed to prevent forgery of the request.
- Multi-country synchronization: When the "Unified Configuration Switch" is turned on, configuration changes will be automatically synchronized to other countries. Please confirm the impact of changes on other countries.
- Environmental Differences: The test environment does not check the IP whitelist for easy debugging; the production environment strongly recommends enabling the IP whitelist to improve security.
4
Related Documents
- Technical parameter configuration (public key configuration)— Detailed steps for public key generation, upload and IP whitelisting, callback address configuration.
- Configuration & Signature— Signature Rules and Signature Verification Mechanism Instructions.
- Environmental information— Each environment request address and platform public key.