n1coePayDocs API reference

Security

What n1co.js protects for you, what is up to you and how to confirm a payment without trusting the browser.

  1. Keep the secret key and the webhook secret only on your server.
  2. Serve your pages over https, load n1co.js from the n1co host and use page_origins.
  3. Confirm every payment on your server before fulfilling the order.
Confirm a payment on your server
curl -s https://api-epay.dev.n1co.dev/v1/payment_intents/pi_UGF5bWVudEludGVudEV4YW1w \
  -H "Authorization: Bearer $N1CO_SECRET_KEY"
# Fulfill the order only if "status" is "succeeded" and "amount" and "currency" match your order.

What n1co.js does for you#

  • n1co iframes. The card element and 3D Secure are served from the n1co origin: neither your page nor its scripts can read them.
  • Tokenization. The number and code are tokenized before they reach the API. Your page only receives the brand, the last four digits and the expiry date.
  • Verified origin. With page_origins, the API refuses any other page.
  • Secure page. n1co.js does not mount on http://, except localhost and 127.0.0.1.

What is up to you#

  • Keep the secret key and the webhook secret in a secrets manager. If they are exposed, rotate them.
  • Hand each client_secret only to its buyer's page.
  • Load n1co.js from the n1co host; to pin a version, use the SRI path.
  • Verify the signature of every webhook and discard duplicates.
  • If your page has a Content Security Policy, allow the n1co.js host:
Content-Security-Policy: script-src 'self' https://elements.n1co.dev; frame-src https://elements.n1co.dev

Personal data and PCI#

The name, email and phone you send in customer, and the billing details, are personal data. ePay never returns customer data, and webhooks do not carry billing details. Do not put sensitive data in metadata.

With n1co.js, your page and your server do not store, process or transmit card data. Check with your PCI assessor which questionnaire applies to you.