- POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL.
- Redirect the client to the payment URL.
- Server receives payment notification through webhook and verify the payment (through the signature attached to the payload).
Step 1 is typically performed by the server to avoid leaking the API key to the client.
However, if I were to generate the payment URL on the client's side (for performance -- eliminate one RTT to server), the API key will be leaked to the public.
What would be the security implications of that?
Step 3 security
For Coinbase, the webhook signature uses a different API key so I can still verify the authenticity of the payment notification through the signature.
For G2A Pay, I can perform a GET to the payment gateway with the transaction id to verify the payment.
Potential vulnerabilities considered
With the API key, any user will be able to make a payment and attribute it to another user (by specifying the other user's id in the metadata). However, there would be no incentive for any user to do so.