Recharge API Integration Security Checklist for Developers

October 26, 2026 2 min read By A1Topup Team Recharge API

Key takeaways

Never put API credentials in an app or web page
Trust a callback only for your own pending orders
One order id per recharge, always

A recharge API is a payment API. If someone gets your credentials, they can spend your wallet. Most problems we see are not clever attacks, just small shortcuts taken on the first day of integration.

The checklist

Credentials stay on the server. The app talks to your server; your server talks to the API.
Whitelist your server IP with the provider.
Use HTTPS everywhere, including your callback URL.
Unique order id for every request.
Never retry pending; check status with the same order id.
Verify callbacks: known order id, still pending, expected values.
Limit amounts per user and per day on your side.
Log every request and response with time and order id.
Change passwords when a developer leaves.
Watch the wallet: a sudden drop should alert someone.

Pro tip

Create a separate, low-limit API user for testing. If test credentials leak, the damage is capped.

Shortcuts that cause trouble

API password inside the Android app
Sample credentials left in public documentation
A callback that refunds without checking the order status

Conclusion

Security for a recharge integration is mostly discipline. Run this list before go-live and again every few months. Full integration details are in the API documentation.

Integrating the recharge API?

Docs, samples and a Postman collection.

API documentation Recharge API