Keep credentials on your server
Route payment requests through your backend. Store secrets securely and keep them out of browser code, mobile bundles, URLs and logs. Use separate configuration for test and live environments.
Prepare: secure secret storage, HTTPS and restricted access to configuration.

