Security

Integrate exclusively with Rollo APIs, webhooks, and hosted checkout. Keep secret keys on your servers, verify webhook signatures, and treat checkout sessions as short-lived credentials for a single customer payment attempt.

API keys

Test keys (rk_test_) operate in Sandbox. Live keys (rk_live_) require an approved account. Rotate keys from Settings if they are exposed.

Hosted checkout

Live card collection runs inside an isolated frame under /pay/{id}/frame. Parent pages receive Rollo session metadata only. Always serve success and cancel URLs over HTTPS in production.

Webhooks

Require HTTPS endpoints (localhost is allowed for local development). Verify signatures on every request and ignore events your endpoint is not subscribed to handle.