PayVala Security
Security implementation is based on each organization's configuration.
PayVala provides security mechanisms for protecting API communication between partner systems and PayVala services.
Secure API Communication
API requests can be protected using authentication, request signing, and payload encryption.
JWE Payload Encryption
The PayVala Partner Management API supports end-to-end payload encryption using JWE and JWKS.
Encryption Format
Key Exchange
Content Encryption
Key Format
Encoding
Secure API Request
Request payloads are encrypted using the applicable PayVala public encryption key.
| Header | Description |
|---|---|
Authorization | Bearer <AccessToken> |
Content-Type | application/jose |
x-jwe-alg | RSA-OAEP-256 |
x-jwe-enc | A256GCM |
Secure API Response
Applicable API responses can be encrypted using the partner public key retrieved from the partner JWKS endpoint.
Public Key Management
Each party exposes a JWKS endpoint containing its applicable public encryption keys.
| Field | Description |
|---|---|
kty | Key type. The documented implementation requires RSA. |
kid | Unique key identifier. |
use | Intended key usage. Encryption keys use enc. |
alg | Encryption algorithm. RSA-OAEP-256. |
n | RSA modulus encoded using Base64URL. |
e | RSA public exponent encoded using Base64URL. |
Public Security Key Endpoints
/.well-known/jwks.jsonSignature key
/.well-known/jwe-public-key.jsonEncryption key
JWS Request Signing
Request signing using JWKS provides authenticity using an RS256 signature.
| Field | Description |
|---|---|
jwsSignature | Signed payload. |
Secure Key Rotation
Multiple Keys
JWKS may contain multiple public keys.
Key Identification
Each key is identified using the kid value.
JWE Key Selection
The kid value in the JWE header identifies the applicable decryption key.
Non-Disruptive Rotation
New keys can be added without interrupting existing integrations.
Originating IP Configuration
The originating IP address of an API request must be configured in the PayVala Operations Execution and Management System (POEMS) to enable access.
Secure Integration Practices
Protect Private Keys
Keep private cryptographic keys protected and accessible only to authorized systems.
Protect Credentials
Store access credentials securely and prevent unauthorized exposure.
Use Correct Environment
Use the credentials, keys, endpoints, and configuration applicable to the selected environment.
Protect Sensitive Data
Do not expose credentials, tokens, private keys, or other sensitive security information.