From Dev.to
Security Checklist for Merchants Accepting Crypto Payments
In short Treat your API key like a password: keep it on your server, never in browser code or a public repository. Mark orders as paid only from a server-to-server notification whose signature you've...