Integration security guide

API Key Security

Super provides two types of API key: a publishable key and a Super key. Only your Super key needs to be kept secure - your publishable key is safe to use client-side.

Never expose your Super key client-side. Super keys must only be used in server-side code. They should never appear in browser JavaScript, mobile app binaries, or public repositories.
Use environment variables. Store your Super key in environment variables or a secrets manager - never hardcode it in source files.
Rotate your Super key immediately if you suspect it has been compromised. You can generate a new one at any time in the Business Portal under Developers → API Keys.
Use your sk_test_ Super key for all sandbox testing and your sk_prod_ Super key only in production environments.

Webhook Security

Super signs every webhook request so you can verify it genuinely came from Super and hasn't been tampered with.

You must verify the webhook signature on every incoming event before processing it. Do not trigger any fulfilment, confirmation, or business logic based solely on the contents of an unverified webhook payload.

For the full signature verification steps, see the Webhooks guide.

PCI Compliance

Super's hosted payment environment is PCI DSS compliant. All sensitive cardholder data is captured and processed within Super's secure, hosted environment - your servers never handle raw card data directly.

Your PCI compliance obligations depend on your integration type:

Integration type	Cardholder data handled by your server	PCI scope
Hosted Page	No	SAQ A
Payment Links	No	SAQ A
Embedded	No	SAQ A

You remain responsible for securing your own infrastructure, API keys, and webhook endpoints in line with your organisation's security policies.

Content Security Policy (CSP)

If your site enforces a Content Security Policy, add the following directives to allow Super's components to load and operate correctly.

connect-src

https://*.superpayments.com
https://api.storyblok.com
https://q4g4k4pw47biltffyqrfab7q7m0jaagm.lambda-url.ap-south-1.on.aws
https://*.sentry.io
https://cdn.segment.com
https://*.seondnsresolve.com
https://api.stripe.com
https://maps.googleapis.com
https://*.adyen.com
https://*.stripe.network

script-src

https://*.superpayments.com
https://js.stripe.com
https://b.stripecdn.com
https://m.stripe.network
https://*.adyen.com

img-src

https://cdn.superpayments.com
https://a.storyblok.com
https://*.adyen.com
https://*.stripe.com

frame-src

https://*.js.stripe.com
https://js.stripe.com
https://hooks.stripe.com
https://*.superpayments.com
https://*.adyen.com