SECURE YOUR PAYSTACK ACCOUNT

Secure your Paystack Account.

Work through these protections one at a time. If you manage Paystack for a business, protect the Dashboard, team access and payment infrastructure—not just your password.

Your Paystack Account can control real business payments.

Paystack can give you access to transactions, customers, settlements, disputes, team permissions and developer infrastructure. A compromised Dashboard can therefore affect much more than one person's login.

Paystack currently supports protections including two-factor authentication, passkeys, backup codes, team roles and API-key security controls.

PAYSTACK ACCOUNT SECURITY

Work through these protections one at a time.

Paystack's Dashboard is evolving, and some navigation can differ between accounts. Use the security options shown in your own official Dashboard and verify each protection after setting it up.

Turn on two-factor authentication

Add another layer of protection so a stolen Paystack password is less likely to be enough to access your Dashboard.

Click to see protection steps

Step-by-step

Sign in to the official Paystack Dashboard.
Open Settings.
Open the Profile tab.
Find Two-factor authentication.
Turn on the two-factor authentication option.
Open a supported authenticator app.
Scan the QR code shown by Paystack, or enter the setup code manually.
Enter the six-digit code generated by the authenticator app.
Complete the setup and save your legitimate backup codes securely.

VERIFY: Return to your Paystack Profile settings and confirm that two-factor authentication is enabled.

Save your Paystack backup codes

Backup codes provide another way to access your Dashboard if you lose access to your authenticator device.

Click to see protection steps

Step-by-step

Open your Paystack Profile security settings.
Locate the available backup codes.
Save them somewhere secure that only you can access.
Do not send backup codes to another person.
Do not store them in a publicly accessible document.
Remember that a backup code can be used only once.
Generate new backup codes when the available codes have been exhausted.

VERIFY: Confirm that your backup codes are safely stored and that you know where to find them if your authenticator becomes unavailable.

Use a strong, unique password

Paystack recommends a passphrase or complex password to reduce the risk of unauthorized Dashboard access.

Click to see protection steps

Step-by-step

Open your Profile settings.
Locate the password-management option available on your Dashboard.
Create a strong password or passphrase that you do not use on another important account.
Avoid passwords based on your business name, phone number or easily guessed information.
Store the password securely, preferably in a reputable password manager.
Never give your password to someone claiming to be Paystack support.

VERIFY: Confirm that your Paystack password is unique and that nobody else knows it.

Set up a passkey when available

A Paystack passkey can allow you to sign in using your device's biometric security, screen lock or supported security key.

Click to see protection steps

Step-by-step

Sign in to the official Paystack Dashboard.
Open Settings.
Open the Profile tab.
Find the Passkeys section.
Choose the option to create a passkey.
Follow your device's fingerprint, face, screen-lock or security-key instructions.
Complete the setup.

VERIFY: Confirm that the passkey appears in your Paystack security settings and that you can use it to authenticate.

Protect your team members' access

Do not share one Paystack login among everyone who needs access. Give each person their own account and appropriate role.

Click to see protection steps

Step-by-step

Open Settings on your Paystack Dashboard.
Open the Team section.
Review every person who currently has Dashboard access.
Confirm that each person still needs access.
Give each team member the minimum role required for their work.
Never give someone your own Dashboard password so they can perform a task for you.
Remove or change access when someone leaves the business or changes responsibilities.

VERIFY: Confirm that every listed team member is authorized and has only the access they actually need.

Enforce 2FA for your team

Paystack allows administrators to require two-factor authentication for team members.

Click to see protection steps

Step-by-step

First enable 2FA on your own Paystack account.
Open Settings.
Open the Team section.
Select Enforce 2FA.
Choose whether the requirement should take effect immediately or at a later date.
Confirm the enforcement setting.
Inform your team members that they must complete their own 2FA setup.

VERIFY: Confirm that the team members who need protection are required to use two-factor authentication.

Review team roles carefully

Different Paystack roles have different permissions. Giving someone more access than necessary increases the impact of a compromised account.

Click to see protection steps

Step-by-step

Open Settings → Team.
Review each team member's assigned role.
Check whether the person needs Admin access.
Where appropriate, assign a more limited role based on the person's actual responsibilities.
Pay particular attention to access involving Transfers, API Keys & Webhooks and settlement settings.
Review permissions whenever a team member changes responsibilities.

VERIFY: Confirm that no team member has administrative or sensitive access simply because it was convenient to assign it.

Remove access when someone leaves

A former employee, contractor or developer should not retain access to your Paystack Dashboard after their work ends.

Click to see protection steps

Step-by-step

Open Settings → Team.
Review the list of current users.
Identify people who no longer work with the business or no longer need access.
Remove or revoke their Dashboard access.
Review API-key access if the person was a developer.
Review other credentials or integrations they may have handled.

VERIFY: Confirm that former team members no longer appear as active users with access to the Dashboard.

Protect your Secret API Key

A Paystack Secret Key can authorize API requests on your account. It must be treated as a highly sensitive credential.

Click to see protection steps

Step-by-step

Open Settings → API Keys & Webhooks when managing your integration.
Identify your Secret Key and Public Key separately.
Never publish your Secret Key in frontend code.
Never put your Secret Key in a public GitHub repository.
Never paste it into a public chat, screenshot or social-media post.
Store it securely using environment variables or a secrets manager.
Restrict access to the people and systems that actually need it.

VERIFY: Confirm that your Secret Key is stored privately and is not exposed in client-side code, public repositories or public messages.

Know the difference between Public and Secret Keys

Paystack provides different API keys for different purposes. Never substitute a Secret Key where a Public Key is intended.

Click to see protection steps

Step-by-step

Open API Keys & Webhooks.
Identify the Public Key.
Identify the Secret Key.
Remember that Public Keys may be used on the frontend for supported Paystack integrations.
Keep Secret Keys on your backend.
Never place a Secret Key inside browser JavaScript or another client-side application.

VERIFY: Confirm that your application uses the correct key in each environment and that the Secret Key remains server-side.

Use Test Mode before Live Mode

Test Mode allows you to test payment integrations without processing real customer money.

Click to see protection steps

Step-by-step

Open your Paystack Dashboard.
Use Test Mode while developing or testing your integration.
Use Paystack's legitimate test payment details.
Confirm that your integration works correctly before switching to live payments.
Keep test keys separate from live keys.
Do not accidentally place live Secret Keys in development code or test repositories.

VERIFY: Confirm that your development environment is using Test Keys and that Live Keys are restricted to the production environment.

Rotate a compromised Secret Key immediately

If a Secret Key is exposed, changing your password alone is not enough. The compromised key itself must be replaced.

Click to see protection steps

Step-by-step

Stop and investigate where the Secret Key was exposed.
Open Settings → API Keys & Webhooks.
Select Generate new secret key.
Choose the appropriate expiration timing for the old key.
Authenticate with your Paystack account password when requested.
Generate the new key.
Update your secure server-side environment with the new key.
Confirm that your application is using the new credential before the old one expires.

VERIFY: Confirm that the exposed Secret Key has been deactivated and that your production integration is using the replacement key.

Restrict API access with IP whitelisting

For supported Paystack API use, IP whitelisting can restrict Secret-Key requests to approved public IP addresses.

Click to see protection steps

Step-by-step

Review whether your integration uses a stable, trusted public IPv4 address.
Open the relevant API Keys & Webhooks or developer security settings.
Locate the IP whitelisting option where available.
Add only the public IP addresses that should make requests with the Secret Key.
Confirm that your production server uses one of the approved IP addresses.
Review the whitelist whenever your infrastructure changes.

VERIFY: Confirm that only trusted production IP addresses are authorized to make Secret-Key API requests.

Protect your webhooks and server

Payment integrations depend on backend systems. A secure Paystack account also requires secure server-side handling.

Click to see protection steps

Step-by-step

Keep your webhook URL on infrastructure you control.
Use HTTPS for your payment integration.
Keep your server and application dependencies updated.
Do not expose server credentials in browser code.
Protect environment variables containing payment credentials.
Review your webhook configuration when changing hosting or payment infrastructure.

VERIFY: Confirm that your webhook and backend infrastructure are using HTTPS and that sensitive credentials remain server-side.

Verify payments from your Dashboard

A customer saying that they paid is not proof that the payment succeeded. Verify important transactions through your own Paystack records.

Click to see protection steps

Step-by-step

Open the official Paystack Dashboard.
Open your Transactions area.
Find the transaction in question.
Check its status, amount and reference.
Do not rely only on a customer screenshot or payment message.
If your website integration is involved, verify the transaction on your server as well.

VERIFY: Confirm the payment through your own Paystack transaction records before treating it as successful.

Beware of fake payment confirmations

Fraudsters can send edited screenshots, fake receipts or messages claiming that a payment has been completed.

Click to see protection steps

Step-by-step

Do not release goods or services based only on a screenshot.
Open your Paystack Dashboard directly.
Check the transaction status.
Confirm the amount and transaction reference.
If your integration supports server-side verification, confirm the transaction there as well.
If the payment is not confirmed, stop and investigate before releasing the product or service.

VERIFY: Confirm that the payment appears as successful in your own Paystack records before treating it as completed.

Review suspicious account activity

Paystack provides audit logs and other account records that can help businesses investigate changes and activity.

Click to see protection steps

Step-by-step

Open your official Paystack Dashboard.
Locate Audit logs where available.
Review important changes to account settings, team access or developer configuration.
Look for changes you do not recognize.
Investigate unfamiliar API-key changes, team changes or other sensitive activity.
If you find suspicious activity, secure the account immediately and contact Paystack.

VERIFY: Confirm that important recent security-sensitive changes were authorized by you or an authorized team member.

Beware of fake Paystack support

Scammers may impersonate Paystack staff and ask for passwords, OTPs, API keys or other sensitive information.

Click to see protection steps

Step-by-step

Be cautious when someone unexpectedly claims to be Paystack support.
Never give your password or 2FA code to an unexpected contact.
Never send your Secret API Key to someone through WhatsApp, email or social media.
Do not allow an unknown person to control your computer remotely.
Do not transfer money because someone says it is necessary to secure, activate or unlock your Paystack account.
Contact Paystack through an official support channel instead.

VERIFY: Confirm unexpected support requests independently before sharing information or making changes to your Paystack account.

Avoid fake Paystack websites and links

Phishing pages can imitate Paystack and capture your login credentials or other sensitive information.

Click to see protection steps

Step-by-step

Access Paystack through the official website or Dashboard.
Be cautious with unexpected links received through email, SMS, WhatsApp or social media.
Check the website address before entering your credentials.
Do not enter your password or 2FA code into an unfamiliar page.
Never download a Paystack application or security tool from an unsolicited link.
If a message creates urgency or threatens account closure, stop and verify it independently.

VERIFY: Confirm that you are on the legitimate Paystack website before entering your Dashboard credentials.

Keep your devices updated

The devices used to access your Paystack Dashboard should receive current security updates.

Click to see protection steps

Step-by-step

Update your computer or phone's operating system.
Update your browser.
Update applications used to manage your Paystack business.
Remove software you no longer need.
Avoid accessing the Dashboard from a device you believe is infected.
Use a trusted network when performing sensitive account administration.

VERIFY: Confirm that the device you use to administer Paystack is receiving current security updates.

Report a compromised Paystack account

If you suspect unauthorized access, treat it as an incident rather than an ordinary account-settings problem.

Click to see protection steps

Step-by-step

Stop making unnecessary changes to the account.
If your Secret Key may have been exposed, rotate it immediately.
Review your team members and revoke unauthorized access.
Review suspicious account activity and audit logs where available.
Change your password if you believe it has been exposed.
Review your 2FA settings.
Preserve screenshots, timestamps, transaction references and suspicious messages.
Contact Paystack through its official support channel and explain what happened.

VERIFY: Confirm that unauthorized credentials or access have been secured and that Paystack Support has received your incident report.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →

Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →

Paystack security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts