Recharge Software Security: 12 Things to Check Before You Go Live

A recharge platform is a wallet system. Every retailer balance, every fund request and every API key is money that someone may try to take. Most incidents in this business are not clever hacks; they come from a reused password, an admin panel open to the whole internet, or an API key sitting in a shared WhatsApp group.

Use these 12 checks before launch, and once every few months after.

Logins and access

1. OTP on admin and distributor logins. A password alone is not enough for accounts that can add balance.
2. Separate admin URL and IP limits. The admin panel should not sit at an easy address open to everyone. Limit it to your office IPs or a VPN if you can.
3. Staff roles. Your support person does not need the power to add funds. Give each staff member only what their job needs.
4. Login alerts. A WhatsApp or SMS alert on every admin login, so you know at once if it was not you.

Money and wallets

5. Two-step fund approval. Large manual credits should need a second person, or at least an OTP.
6. Daily reconciliation. Wallet totals in your software should match your API provider balance and bank statement every day. A gap that grows is a warning.
7. Limits. Daily limits per retailer and per transaction stop one stolen account from emptying a large balance.

API and server

8. IP whitelisting. Your recharge API provider should accept requests only from your server IP. Most good providers require this.
9. Keys out of the code. API keys and passwords belong in a config file outside the public folder, never in the website code or a screenshot.
10. Check callbacks. Before marking a recharge as success or refunding it, confirm the callback is genuine, and check the status API if in doubt.
11. HTTPS, updates and backups. SSL everywhere, server updates on time, and daily backups stored away from the main server.

People

12. Train your team. No real company will ask for an OTP or the admin password on a call. Make that a rule your staff and distributors know.

Pro tip: once a month, log in as a test retailer and try things you should not be able to do: open another user's report, change a commission, or reach the admin page. It takes 15 minutes and finds real holes.

Questions to ask your software provider

• Is OTP login available for admin and distributors?
• Can the admin panel be limited by IP?
• Where are backups kept, and how often?
• How fast are security fixes applied, and are they included in the renewal?

One more rule that saves money: never refund a "pending" recharge before checking its final status with your API provider.

Need a security review?

A1Topup builds recharge software with OTP logins, role-based staff access and IP-locked APIs. If you already run a platform, we can go through this checklist with you. Talk to us on WhatsApp.