During the code review, we'll perform a screenshare with you to make sure everything is ready to move into production. Below are some things to prepare for before the review to make sure everything goes smoothly.
Make sure your payment flow matches what was described on your Flow of Funds document.
Review our KYC requirements. For integration-specific requirements, refer to your Flow of Funds + CIP.
Familiarize yourself with expected transaction times & fees.
Make sure your site is secure (We require SSL Certificates). Send us your SSL labs report.
Use HMAC for webhooks.
Securely store & encrypt client_id & client_secret.
Don't create passwords when you create a user (Passwords are only needed for users that will login to SynapsePay's dashboard).
Don’t store sensitive user information such as AC/RT numbers, online bank login credentials, SSN, etc.
Supply real IP addresses for users (when a user is created AND when they create a transaction)
Supply fingerprints for your users. If you prefer not to trigger 2FA, supply a hashed fingerprint instead.
Use webhooks to stay updated on your users, nodes & transactions.
Be aware that returns & chargebacks may occur after transactions settle.
Double check the following test scenarios:
- Bank added via online banking logins asks more than one MFA question.
- Bank added via online banking logins returns multiple accounts.
- Bank added via account/routing number requires micro-deposits.
- Receiving webhooks.
Prevent duplicate creation of users, nodes and transactions with idempotency keys.
Review required disclosures & notifications.
Let customers know what to expect on their bank statement (Your Business Name + Support Number).
Let customers know how to cancel, change or dispute a transaction with you.
In the case of a return: If funds were already sent to the recipient, please notify the recipient that we will be debiting those funds back from their account (this reduces the risk of chargebacks)
To expedite the process, please follow the steps below before we issue your keys:
Upload all required business docs on the client manager.
Fund your reserve on the dashboard.
Find more info on Request API Access.
If you have questions, let us know!