digid pay

Theme

Security ​

Security for a digid pay integration is mostly key hygiene and knowing what not to touch. Card data never enters your systems, so the attack surface you own is your keys, your webhook endpoint, and your order logic.

Key handling ​

  • Store the secret key in a secret manager; never in code, config committed to git, or client bundles.
  • Use the publishable key in the browser only.
  • Label keys by purpose and scope them where possible (see Authentication).
  • Rotation cadence: rotate on personnel change, on suspected exposure, and periodically (a reasonable default is every 90 days for high-volume servers). Rotation is instant; the old secret stops authenticating.
  • Revoke immediately any key you suspect is exposed. Revocation is effective within seconds. digid pay alerts you on misuse signals — treat an alert as an active exposure: rotate, then investigate.

Webhook endpoint hygiene ​

  • Verify the Digidpay-Signature HMAC on every delivery (Webhooks).
  • Keep a 300s timestamp replay window.
  • Process idempotently (events are at-least-once).
  • Return 2xx fast; your endpoint should be able to absorb bursts.

Misuse alerts ​

digid pay detects obvious signals (secret key used from a browser context, unusual volumes, unexpected geographies) and surfaces them in the dashboard with a one-click rotate action. Wire your own alerting on top for your side (e.g. watch your webhook endpoint and payment-failure rate).

PCI do / don't list ​

Do

  • Capture cards only through digid pay Secure Fields.
  • Use tokens (pmt_…) in confirmations.
  • Fulfil on verified webhooks.
  • Keep keys server-side, scoped, rotated.
  • Let the acquirer handle SCA; never bypass it.

Don't

  • Don't build your own card form or collect card numbers yourself.
  • Don't send, store, or log raw card-number fields anywhere. The API rejects them — and you should too, at the source.
  • Don't ship a secret key to the browser (it is rejected, and flagged).
  • Don't fulfil on a client callback alone.
  • Don't disable or shortcut 3-D Secure to "improve conversion".

The PCI do/don't in one line ​

Card entry happens inside digid pay's vault boundary — keep it that way and your PCI burden stays at the lowest SAQ class (PCI posture).

digid pay — built in Europe.

© 2026 digid