🔐 API Authentication – AeronPay

To ensure secure communication and prevent unauthorized access, all AeronPay API requests require authentication via HTTP headers. Only whitelisted IPs are allowed to access the API services.

🛡️ Authentication Requirements

Each API request must include the following headers:

📍 Example Header

POST /api/serviceapi-prod/endpoint-name HTTP/1.1
Host: api.aeronpay.in
client-id: YOUR_CLIENT_ID
client-secret: YOUR_CLIENT_SECRET
Content-Type: application/json

🔐 IP Whitelisting (Mandatory)

For enhanced security, access to AeronPay APIs is restricted to whitelisted IP addresses only. Requests originating from non-whitelisted IPs will be rejected automatically.

To whitelist your IP:

• Share your server's static IP address with the AeronPay technical support team.
• Ensure your application runs from the registered IP to access the APIs.

❗

Note: IP whitelisting is enforced in both UAT and Production environments.

🔄 Tokenless Authentication

AeronPay APIs currently use tokenless header-based authentication. Please keep your client-id and client-secret confidential.

🔐 IP Whitelisting Policy – Production Environment

📌 Purpose

This document defines the mandatory IP Whitelisting Policy for accessing the Production APIs.
The policy ensures strong isolation, traceability, and prevention of unauthorized or shared access across merchants.

This policy is strictly enforced and applies to Live Merchants without exception.

🔒 Core Security Rules

1 Merchant ID (MID) → Maximum 8 Static IPs → Exclusive Ownership

• A maximum of 8 static IP addresses may be whitelisted per Merchant ID
• Each IP address is exclusive to one MID only
• No IP address can be reused or shared across multiple MIDs or other entities

✅ Whitelisting Rules

1️⃣ Maximum IP Limit per MID

• Each Merchant ID can whitelist up to 8 static public IPv4 addresses
• Requests exceeding 8 IPs will be automatically rejected
• IPs are approved only for Production access

❌ More than 8 IPs under a single MID
❌ Temporary / dynamic IPs

2️⃣ Exclusive IP Ownership (Critical Rule)

Once an IP is approved:

• That IP becomes permanently mapped to a single MID
• The same IP will never be approved for another MID
• IP duplication across MIDs is strictly prohibited

Any attempt to reuse an IP across MIDs will result in rejection and security flagging.

3️⃣ Static IP Requirement

Allowed:

• Static public IPv4 from:

  • Dedicated servers
  • Cloud VM (AWS / Azure / GCP) with reserved IP
  • Firewall-backed NAT gateway

Not Allowed:

• Dynamic or rotating IPs
• VPNs, proxies, or tunnel IPs
• Residential or mobile network IPs
• Shared NAT IPs used by multiple merchants

🚫 Prohibited Scenarios

🔄 IP Replacement / Modification Policy

IP changes are controlled and audited.

IP replacement allowed only when:

• An existing approved IP is removed first
• Total IP count never exceeds 8
• A formal IP change request is submitted
• Compliance approval is granted

⏱ Processing Time: 24–48 business hours
⚠ No instant or emergency changes

🧾 Audit, Monitoring & Enforcement

All API requests are continuously logged and validated against:

• Merchant ID
• API credentials
• Source IP address
• Timestamp and endpoint

If the source IP does not match the MID whitelist:

• Request is immediately blocked (HTTP 403)
• Event is logged for audit review
• Repeated violations trigger account suspension

🔐 Multi-Layer Enforcement

Security controls are enforced at:

1. Network Firewall
2. API Gateway IP Filter
3. Application-level MID binding
4. Rate-limit and anomaly detection layer

Bypassing any layer is technically prevented.

🛑 Violation Consequences

Any of the following will lead to enforcement action:

• Attempt to use one IP for multiple MIDs
• Exceeding the 8-IP limit
• Unauthorized IP access attempts
• Repeated rejected requests

Consequences:

• Immediate API access suspension
• Merchant flagged under security review
• Reactivation only after compliance clearance

📤 IP Whitelisting Request Format

Merchants must submit:

Merchant ID (MID):
Registered Legal Entity Name:
List of Static IPs (Max 8):
Server Provider (AWS / Azure / GCP / On-Prem):
IP Ownership Declaration:
Authorized Signatory Name:

Incomplete or invalid requests will be rejected without processing.

🏛 Compliance Alignment

This policy is aligned with:

• RBI Cyber Security Framework
• ISO 27001 – Access Control
• PCI-DSS Network Segmentation
• Bank-grade API Security Standards

📢 Final Declaration

Each IP address is exclusive, traceable, and non-transferable.
Each Merchant ID is isolated and independently secured.

Failure to comply with this policy will result in permanent production access denial.

📞 Support

All requests must be routed through official channels only:

📧 [email protected]