Payment security basics

Let the gateway's hosted page or checkout collect card details. Your site then never sees card numbers, which keeps you out of the heaviest compliance requirements. Protect API keys, verify webhook signatures and use HTTPS everywhere.