Responsible integrations
Server-protected keys, HTTPS destinations and event validation as documented.
Security and reliability
When money is involved,every detail matters.
Trust comes from controls that can be explained. From company identity to event confirmation, care follows the operation.
SecurityControl at every point along the way.
Explore how identity, intent and evidence connect in the payment lifecycle.
Identity and access
Controls along the journey
Security is a continuous practice. Every integration also has validation, storage and access-control responsibilities.
Traceable operations
Identifiers and statuses connect charges to their tracking.
Purposeful performance
Asynchronous delivery and status tracking connect systems without confusing a request with its completion.
Built to connect
Clarity to integrate. Context to evolve.
Public contracts, examples and an integration journey connecting your application to the payment lifecycle.
Explore documentationakkro / integration
POST /v1/transactionsHost: api.akkropay.appx-api-key: <YOUR_SERVER_KEY>X-Idempotency-Key: <ORDER_KEY>Content-Type: application/json { "amount": 27900, "paymentMethod": "pix", "customer": { "name": "Example", "email": "demo@example.com", "document": { "type": "cpf", "number": "<CUSTOMER_CPF>" } }, "items": [{ "title": "Example", "unitPrice": 27900, "quantity": 1, "tangible": true }]}api.akkropay.appExplore documentation
Read-only example. Consult the complete contract before integrating. No public test environment is available.
Security and data protection
Every piece of data has a purpose. Every access, a responsibility.
The same care that connects a charge to a balance should guide data processing. Understand the boundaries between the buyer experience, integration and operation.
Buyer
Gets a payment experience with context about the order.
Your backend
Protects credentials and sends the data needed for the operation.
Payment and events
The reference connects the charge to received confirmations.
Your operation
Checks the state and restricts access to account information.
Purpose and minimization
Send the data the workflow needs. Keep personal information out of URLs, logs and measurement tools.
Credentials and evidence
Keep secrets in your backend, validate incoming events and retain the transaction reference to investigate inconsistencies.
Clear responsibilities
Data processing roles depend on the operation and contracts. Brazil's LGPD also involves transparency, retention and handling data subject rights.
Privacy on this visit, too.
Optional analytics starts only with your permission, when enabled. We do not record sessions or automatically capture forms. You can revisit your choice in the footer.
Good decisions start with clear answers.
Credentials, event confirmation and data protection: practical responsibilities at each stage.
Go deeper in the documentation01Can I put the API key in the browser?
No. Payment API credentials belong in your backend, outside public JavaScript, repositories and logs. Separate the buyer experience from the code that authorizes an operation. If a credential is exposed, replace it and review its use.
Explore this topic02How does my system confirm a payment securely?
Receive webhooks in your backend, validate signatures when a secret is configured and handle repeated events idempotently. Match each event to the order reference and query the transaction when needed. The buyer's visual return alone should not release an order.
Explore this topic03How can I retry without creating a duplicate charge?
Preserve the X-Idempotency-Key when retrying the same financial intent and follow the endpoint's rules. A timeout does not prove failure: check the state before starting another intent. A different charge must be treated as a new operation.
Explore this topic04How does data protection fit into the integration?
Define a purpose for each piece of data, collect only what is needed and restrict access. Each participant's responsibilities depend on the processing and applicable agreements. Technical controls support protection; policies, retention and handling data subject rights also belong in your operation.
05Does the site record sessions or require analytics consent?
No. Optional website analytics requires your permission when enabled. The configuration does not record sessions or automatically capture forms. You can decline or revisit your choice in the footer while retaining access to the content and demonstrations.
Your next operational chapter starts here.
Discover the Akkro platform and follow your payments with context.