Skip to content

Worldpay Access Token

Service Name: Worldpay

Service Description: Worldpay is a global payment processing company that provides payment services for online businesses, including payment gateways, fraud prevention, and merchant accounts. It enables businesses to accept and process various payment methods securely.

Service Address: https://www.worldpay.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through Worldpay's merchant portal.

Secret Access Scope: Grants access to Worldpay's payment processing API, allowing merchants to process transactions, manage refunds, and access payment data.

Secret Revokement URL: https://developer.worldpay.com/docs/access-worldpay/settings/api-keys

Secret Example: T_S_fd3d0eea-cf86-4102-a6cd-7b9d21e7bb3c

Suspicious Activity Investigation Instructions:

  • Review transaction logs in the Worldpay merchant portal for unusual payment activities
  • Check for unexpected API calls or access from unfamiliar IP addresses
  • Monitor for unusual transaction patterns, especially high-value transactions or transactions from new geographic regions
  • Verify if there are any unauthorized refunds or chargebacks
  • Review webhook configurations to ensure they haven't been altered

Mitigation Instructions:

  • Log in to your Worldpay merchant account
  • Navigate to Settings > API Keys section
  • Identify the compromised API key/token
  • Click on "Revoke" or "Delete" to invalidate the token
  • Generate a new API token with appropriate permissions
  • Update your applications with the new token
  • Consider implementing IP restrictions for API access
  • Enable additional security features like two-factor authentication for your

Worldpay account

  • Review and update webhook endpoints to ensure they point to legitimate URLs