Skip to main content

Token Encryption Guide

Use a Pre-shared Encryption Key​

Your integration and PayWise share one encryption secret.

  • Keep this key on your side only
  • Encrypt locally (client, backend, or secure middleware)
  • Send encrypted values only
Never send your pre-shared key to PayWise

Do not include your pre-shared encryption key in headers, request bodies, logs, support tickets, or screenshots.

Transport and Access Controls​

  • Authenticate API calls with PW-subscription-key
  • Enforce source IP allowlisting where configured
  • Keep key material and payload encryption local/offline from PayWise

Algorithm Contract​

PayWise legacy compatibility contract:

  • AES-256-CBC
  • EVP_BytesToKey key derivation (MD5 chain, 8-byte salt)
  • Encrypted envelope payload with ct, iv, s
  • Final wire value is base64-encoded JSON envelope

Which Field Must Be Encrypted?​

EndpointField to send from your appWrapper forwards upstream as
POST /institution/quotesession_token_encsession_token
POST /institution/transactionsession_token_encsession_token
GET /institution/transactiontransaction_id_enctransaction_id

POST vs GET Clarification​

  • POST /institution/transaction: transaction_id is plaintext idempotency id
  • GET /institution/transaction: transaction_id_enc is encrypted

Language Samples​

Download Helper Packages​