NXT Enterprises

Audience: Security, Admins, Developers, Support, SRE Outcomes: Tight security posture; fast troubleshooting; handy endpoint list

Rotate API keys and webhook secrets regularly

Restrict CORS to trusted frontend origins

CSP: allow required Stripe domains; block inline scripts

Never log PANs or raw webhook payloads containing secrets

Encrypt at rest; restrict who can view invoices with PII

Least privilege on provider dashboards &amp; internal roles

- Rotate API keys and webhook secrets regularly
- Restrict CORS to trusted frontend origins
- CSP: allow required Stripe domains; block inline scripts
- Never log PANs or raw webhook payloads containing secrets
- Encrypt at rest; restrict who can view invoices with PII
- Least privilege on provider dashboards &amp; internal roles

Card declined (generic) → Ask user to contact issuer or try another card; log <code>stripe_code</code>

Requires authentication → Show 3DS modal; allow retry if closed

Webhook signature invalid → Ensure <code>express.raw()</code> + correct secret; rotate if leaked

Pending forever → Replay webhook; check handler errors

Bank payment not found → Settlement delay; confirm reference; widen date window

SSE not updating → Fix CORS/credentials; ensure <code>withCredentials:true</code>

- Card declined (generic) → Ask user to contact issuer or try another card; log <code>stripe_code</code>
- Requires authentication → Show 3DS modal; allow retry if closed
- Webhook signature invalid → Ensure <code>express.raw()</code> + correct secret; rotate if leaked
- Pending forever → Replay webhook; check handler errors
- Bank payment not found → Settlement delay; confirm reference; widen date window
- SSE not updating → Fix CORS/credentials; ensure <code>withCredentials:true</code>

Operational runbooks (incidents &amp; escalations)

Stripe webhook outage: show status banner; switch to manual reconciliation; after recovery, replay webhooks; verify idempotency

Bank provider delays: communicate ETA; increase webhook retry window; extend deposit deadlines; post manual journal entries with later reversal

Duplicate releases: freeze further releases; validate idempotency keys &amp; recent event IDs; reconcile balances; issue adjustments/refunds if needed

- P1: money lost/wrong recipient → on-call engineer + finance lead + exec
- P2: delayed confirmations → SRE + support

- Stripe webhook outage: show status banner; switch to manual reconciliation; after recovery, replay webhooks; verify idempotency
- Bank provider delays: communicate ETA; increase webhook retry window; extend deposit deadlines; post manual journal entries with later reversal
- Duplicate releases: freeze further releases; validate idempotency keys &amp; recent event IDs; reconcile balances; issue adjustments/refunds if needed
- Escalation ladder:
 - P1: money lost/wrong recipient → on-call engineer + finance lead + exec
 - P2: delayed confirmations → SRE + support

POST /api/payments/intents POST /api/payments/stripe/checkout-session POST /api/webhooks/stripe

POST /api/payments/bank/link POST /api/webhooks/bank

POST /api/escrow/deploy-contract POST /api/escrow/monitor-deployment POST /api/escrow/release

<code>401</code> Unauthorized, <code>403</code> Forbidden (role/KYC), <code>404</code> Not found, <code>400</code> Validation, <code>500</code> Internal

Send a stable reference for create/confirm/release; webhooks processed once via event ID dedupe

- <code>401</code> Unauthorized, <code>403</code> Forbidden (role/KYC), <code>404</code> Not found, <code>400</code> Validation, <code>500</code> Internal
- Send a stable reference for create/confirm/release; webhooks processed once via event ID dedupe

Reduce attack surface, resolve frequent issues quickly, and use the core endpoints.

Common Fixes, Runbooks & API

Find answers and get help from Intercom Support and Community Experts

This site employs cookies and other technologies that we and our third party vendors use to monitor and record personal information about you and your interactions with the site (including content viewed, cursor movements, screen recordings, and chat contents) for the purposes described in our Cookie Policy. By continuing to visit our site, you agree to our {websiteTermsLink}, {privacyPolicyLink} and {cookiePolicyLink}.

This site uses cookies and similar technologies ("cookies") as strictly necessary for site operation. We and our partners also would like to set additional cookies to enable site performance analytics, functionality, advertising and social media features. See our {cookiePolicyLink} for details. You can change your cookie preferences in our Cookie Settings.

We use cookies to make our site work and also for analytics and advertising purposes. You can enable or disable optional cookies as desired. See our {cookiePolicyLink} for more details.

Advertising cookies are set by our advertising partners to collect information about your use of the site, our communications, and other online services over time and with different browsers and devices. They use this information to show you ads online that they think will interest you and measure the ads' performance. Social media cookies are set by social media platforms to enable you to share content on those platforms, and are capable of tracking information about your activity across other online services for use as described in their privacy policies.

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

These cookies are necessary for the website to function and cannot be switched off in our systems.

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site.

You have the right to opt out of the sale of your personal information. See our {cookiePolicyLink} for more details about how we use your data.

Your Privacy Choices

We use cookies to enhance your experience. You can customize your cookie preferences below. See our {cookiePolicyLink} for more details.

Cookie Settings

Link, Press control-option-right-arrow to exit

Empty Help Center

Uh oh. That page doesn’t exist.

Disappointed

Neutral

Smiley

Thinking...

Searching through sources...

Analyzing...

Tickets submitted through the messenger or by a support agent in your conversation will appear here.

Common Fixes, Runbooks & API

Security hardening

Common errors & fixes

Operational runbooks (incidents & escalations)

Payments API — quick reference