To keep your payments profile secure for the protection of your customers and yourself, bear these security best practices in mind:
-
Never share your payments profile or merchant ID with anyone.
-
Never make a payment to Google through a third party. Always pay any balance due through your Google Account.
-
To send processing commands to Google, use an HTTPS connection secured by a 128-bit secure socket layer (SSL) v3 or a Transport Layer Security (TLS) connection (we don't allow SSL v2).
-
Verify the authenticity of the server certificate presented to you.
-
To get Google notifications, specify an HTTPS callback URL secured by SSL v3 or TLS using a valid certificate from a major certificate authority.
-
Only accept messages authenticated by HTTP basic authentication using your merchant ID and merchant key as the username and password.
-
Validate messages sent to your callback URL before processing them.