Yes. The keys you save in Online payments are stored encrypted and belong to your store alone. Secret keys (passwords, App secret, Signature key) are never shown again after you save them, not even to you. The page is meant for the store owner.
Where to find it
Admin › Administration › Settings › Online payments, and the SSLCommerz settings page linked from it.
The page belongs to the feature Payments & profit (owner). It is marked "Owner only" on the user form. Keep it that way, so staff never see your payment settings.
How it works
- Encrypted. Every gateway's keys are saved in an encrypted form in your store's own settings.
- Secrets stay hidden. These boxes are always empty when you open the page, with "saved — leave empty to keep it":
- bKash: App secret and Password
- aamarPay: Signature key
- ShurjoPay: Merchant password
- SSLCommerz: STORE PASSWORD
- IDs stay visible. The App key, Username, Store ID, Merchant username and Order prefix are shown again, so you can check them.
- Empty means keep. Saving with an empty secret box keeps the saved secret. Type a new one only when you want to replace it.
- Your own accounts. Each store uses its own merchant accounts. Payments go to your account, and no other store's keys are ever used for your shop.
- Never sent to shoppers. Customers see only the payment method's name. The keys are used by the shop's server when it talks to the gateway.
- Return links are signed. When a gateway sends the shopper back, the link carries your store's signature. A changed or copied link is refused, and the payment is still checked with the gateway before anything is marked paid.
Good to know
- Send-money numbers are not secret. They are shown to customers at checkout on purpose, so they can send money.
- Changing keys: make new keys in your gateway's merchant panel, then write them here and press Save.
Common problems
- A secret box looks empty, as if the key was lost. That is normal. Look for "saved — leave empty to keep it" in the box.
- A staff member gets "You do not have access to: Payments & profit (owner)". This is on purpose. Payment settings stay with the owner.
Related
Still need help?
Ask in our Facebook group — the team and other shop owners answer there.
Ask the community →