Best Practices

Make the most of what airpay API docs have to offer.

• Thoroughly understand the API documentation - Before starting your integration, take time to explore airpay’s API document throughout. Understanding the API’s capabilities, endpoints and response structure is key to building effectively. It helps you to anticipate potential issues and align your implementation.

• Implement robust error handling - Design your integration to gracefully manage various error types such as network failures, validation issues, and authentication problems. Incorporate clear error messages and callback mechanisms to maintain a smooth user experience. Consistently log all failures with relevant context to simplify troubleshooting and support.

• Secure API Keys and Access Tokens - Ensure your integration includes proper authentication methods like API keys or OAuth tokens to securely access the API. Always transmit credentials over HTTPS to prevent interception or misuse. Store sensitive information in secure environments, avoiding exposure in client-side code or public repositories.

Security Standards

We handle customer data with the most secure principles aligned with the industry standards. We are compliant with the following standards: ISO 9001:2013, ISO/IEC 27001:2013, SOC1, SOC2, PCI DSS & PCI PIN.

• Validate Input and API Responses - Always validate the data you send to the API to prevent bad requests or transition failures. Likewise, verify and handle the structure of API responses before using the data. This helps maintain consistency and reduces the chances of runtime errors.

• Monitor Transactions and System Health - Set up logs and alerts for payment failures, webhook issues, or unusual transaction patterns. Regular monitoring helps identify problems before they affect end users. Use analytics dashboards offered by the gateway for better visibility and control.

• Common Error Codes - Handle common HTTP error codes to ensure a smooth API experience. Client-side issues like 400, 401 and 403 often relate to invalid requests or authentication. Errors such as 404 or 422 indicate missing resources or validation failures. For 500, 503 and 429, use retries with backoff and monitor rate limits carefully.