# Security

> How to protect your PS Wallet Pay app token and balance: storing and reissuing the token, allowed methods, IP allowlist, and webhook verification.

The app token gives full access to the API, and with `transfer` and `createCheck` enabled, it also gives access to the money on the app balance. These rules will help you protect it.

## In brief

- Store the token on the server only. Do not put it in the code of mini apps, websites, or mobile clients.
- Enable `transfer` and `createCheck` only if you really need them: these methods withdraw money from the app balance.
- Enable the IP allowlist so the API accepts requests only from your servers.
- Verify the signature of every webhook.
- Keep only what you need for operations on the app balance, and withdraw the rest regularly.

## API token

The token looks like `<app ID>:<secret>` and is passed in the `PSWallet-Pay-API-Token` header. You can view it in the app dashboard under "API token" — with PIN confirmation.

- Store the token in environment variables or your server's secrets storage, not in the code or repository.
- Do not pass the token to the browser, a mini app, or a mobile client: any user will be able to extract it. Make API requests only from your own server.
- Do not send the token in chats and do not publish it in logs.

### Reissuing the token

If the token has leaked or you suspect it has, click "Reissue" in the "API token" section (a PIN is required).

> [!WARNING]
> The old token stops working immediately — update it on your server, otherwise requests will receive `401 UNAUTHORIZED`. After reissuing, webhooks are signed with the new token.

## Allowed methods

The `transfer` and `createCheck` methods are disabled by default. You can enable them in the dashboard: "Security" → "Allowed methods":

- "User transfers via API" — the `transfer` method;
- "Check creation via API" — the `createCheck` method.

Enabling is confirmed with a PIN; a method can be disabled without it. If a method is disabled, the API responds with the error `403 METHOD_DISABLED`.

## IP allowlist

Enable the IP allowlist ("Security" → "IP allowlist") so the API accepts requests only from your servers. Requests from other addresses will receive the error `403 IP_NOT_ALLOWED`.

- Individual addresses and IPv4 and IPv6 subnets are supported, for example `203.0.113.0/24` or `2001:db8::/32`.
- IPv4 subnets range from `/8` to `/32`, IPv6 from `/16` to `/128`.
- The list can contain up to 20 entries.
- An empty list means no restrictions.
- Changes to the list are confirmed with a PIN.

> [!TIP]
> If your server accesses the internet through NAT or a proxy, add the external address from which requests are sent to the list.

## Webhooks

- Verify the `PSWallet-Pay-API-Signature` signature of every webhook and respond with `401` if it does not match — see the [Webhooks](https://help.pswallet.org/en/pay-api/webhooks#проверка-подписи) section for details.
- Reject requests whose `request_date` is more than a few minutes old.
- Process events idempotently: the same event may arrive more than once.
- Do not trust the amount and status in a request without verifying the signature. If in doubt, request the invoice via `getInvoices` by `invoice_ids`.

## App balance

Keep only what you need for operations on the app balance (for example, for transfers and checks), and regularly withdraw the rest to your account using the "Withdraw" button in the dashboard.

## App freezing and deletion

If the app is frozen by PS Wallet administration, the API responds with the error `403 APP_FROZEN` and withdrawals from the balance are unavailable. Contact support.

You can delete the app in the settings: "Delete app". The token will stop working, and unpaid invoices will no longer be accepted. Deletion cannot be undone, and the app balance must be zero before deletion.

---
Source: https://help.pswallet.org/en/pay-api/security