Credential hygiene
API credentials live only on your backend, in a secrets manager — never in source control, frontend bundles or mobile apps. Rotate on a schedule and on any suspicion of exposure.
Verify every callback
Wallet callbacks move money. Verify signatures or use mutual TLS, check timestamps against replay windows, and key processing by unique transaction IDs. An unverified callback endpoint is an open wallet.
Minimise player data
Pass opaque player references, not personal data, through game sessions. The less personal data crosses integration boundaries, the smaller your compliance surface.
Transport and access
All integration traffic runs over TLS. Admin and configuration access should be role-based, logged, and limited to the people who need it.