As a non security expert, I'm looking for advice from those who are.
I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment and has asked company X for the secret (private) key related to their payment account. Of course, secret keys are called that for good reason. So what is the "right" way to do this?
My dilemma is that either X shares the key with Y in as secure a way as possible (with the resultant risk that the secret key is somehow compromised)
Y creates the payment account on X's behalf and integrates the secret key server-side so that no key sharing occurs but Y still has to hand over the payment account to X on completion - including account credentials - which carries the same risk of breach.
What am I missing please?