> For the complete documentation index, see [llms.txt](https://docs.payr.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.payr.com/payment-interface/payr-sdk/security-requirements.md).

# Security Requirements

This page covers security considerations when integrating the Payr SDK into your platform.

***

### Content Security Policy (CSP)

If your website has **Content Security Policy (CSP)** configured, you need to allow specific domains for the SDK to function properly.

> **Don't have CSP?** If your site doesn't use CSP headers, you can skip this section. Check with your development or security team if you're unsure.

***

#### Required Domains

Allow these domains in your CSP configuration:

**Payr SDK:**

* `https://cdn.mypayr.co.uk` - Payr SDK script

**Payment Processing:**

* `https://access.worldpay.com` - WorldPay payment processing (production)
* `https://try.access.worldpay.com` - WorldPay payment processing (sandbox)

**3D Secure Authentication:**

* `https://centinelapi.cardinalcommerce.com` - 3DS challenge iframe (production)
* `https://centinelapistag.cardinalcommerce.com` - 3DS challenge iframe (sandbox)

**Payr API:**

* `https://api.mypayr.co.uk` - Payr API (production)
* `https://sandbox-api.mypayr.co.uk` - Payr API (sandbox)

**Wallet Payments (Optional - only if using Apple Pay or Google Pay):**

* `https://applepay.cdn-apple.com` - Apple Pay script
* `https://pay.google.com` - Google Pay script

***

#### Example CSP Configuration

If you need help configuring CSP, here's an example header that allows all required domains:

**For Production (with wallets):**

```
Content-Security-Policy:
  script-src 'self' https://cdn.payr.io https://access.worldpay.com https://applepay.cdn-apple.com https://pay.google.com;
  frame-src 'self' https://access.worldpay.com https://centinelapi.cardinalcommerce.com;
  connect-src 'self' https://api.mypayr.co.uk;
```

**For Sandbox (with wallets):**

```
Content-Security-Policy:
  script-src 'self' https://cdn.payr.io https://try.access.worldpay.com https://applepay.cdn-apple.com https://pay.google.com;
  frame-src 'self' https://try.access.worldpay.com https://centinelapistag.cardinalcommerce.com;
  connect-src 'self' https://sandbox-api.mypayr.co.uk;
```

**Without wallets:**

```
Content-Security-Policy:
  script-src 'self' https://cdn.payr.io https://access.worldpay.com;
  frame-src 'self' https://access.worldpay.com https://centinelapi.cardinalcommerce.com;
  connect-src 'self' https://api.mypayr.co.uk;
```

> **Note:** These are basic examples. Your actual CSP may need additional directives depending on your site's requirements. Consult with your development team to integrate these into your existing CSP policy.

***

### Token Security

#### Auth Token Handling

* The `authToken` from `/user-login/` is **safe to pass to the client**
* It's a **short-lived user session token** (valid for 15 minutes)
* It only grants access to that specific user's payment session
* **Never expose your server API token** in client-side code

#### Best Practices

**Do:**

* Issue session tokens from your backend after user authentication
* Use HTTPS for all API calls and SDK hosting
* Rotate your server API token periodically using `/rotate-token/`

**Don't:**

* Hardcode production server tokens in frontend code
* Expose server tokens in public repositories
* Share tokens across multiple users or sessions

***

### HTTPS Required

**The SDK requires HTTPS for:**

* Apple Pay (strict requirement)
* Google Pay (production environment)
* 3D Secure authentication
* Secure token transmission

**Localhost exception:** During development, `http://localhost` is allowed for testing.

***

### Next Steps

* [**Testing**](/testing.md) - Test in sandbox environment
* [**Environments**](/environments.md) - Configure sandbox vs production

***

### Support

Need help with security configuration? Contact **<support@mypayr.co.uk>**