Stripe live · PayPal live · COD enabled
Public key — safe to expose in frontend assets.
Stored in environment variables, never in source control. Shown masked.
Every webhook must be verified against this signature.