Best practices

Protect your secret key

• Keep sk_live_ only on the server (env vars / secrets manager).
• Never commit keys to git or ship them in mobile/web bundles.
• Rotate compromised keys immediately in Connect.

Fulfill safely

• Do not fulfill based only on callback_url query params.
• Do not fulfill based only on embed onSuccess / postMessage — those are UX signals.
• Prefer signed webhooks; you can start with Verify polling only.
• Make fulfillment idempotent on reference so retries do not double-ship.
• In Connect, “Connected” ≠ delivery OK — use Send test. Opening the webhook URL in a browser is GET; Waaguan delivers via POST.

Send accurate checkout data

• Pass customer_name exactly as registered on MoMo when you have it.
• Ask customers to include the wa- reference in the transfer note when possible.
• Use the exact amount from Initialize — do not round differently on your side.

Checkout UX

• Customers must leave your page to open MoMo — use embed (not popup on mobile) so checkout keeps running in the background.
• Show a clear amount and what name/number they are paying.
• If the charge expires, create a new initialize rather than reusing an expired reference.
• Always fulfill via webhook or Verify — never only via onSuccess if the customer might close the tab.