> For a complete page index, fetch https://docs.transak.com/llms.txt

# Integration Update - Mandatory Security Changes

All partners integrating using Transak's APIs are required to implement the following security changes. These measures protect against fraud, prevent session hijacking, and ensure all API calls are traceable to a verified partner and end user.

Please complete these changes by **15th July 2026** to avoid interruption to your live integration.

## Mandatory Requirements from Partners

<table>
  <thead>
    <tr>
      <th>
        Changes
      </th>

      <th>
        What to Do
      </th>

      <th>
        Example
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        [CORS Protection on APIs](#cors-protection-on-apis)
      </td>

      <td>
        Restrict your APIs to your own front-end domains and block requests from any other origin.
      </td>

      <td>
        `Access-Control-Allow-Origin`

        :

        `https://YOUR_DOMAIN.com`
      </td>
    </tr>

    <tr>
      <td>
        [User IP Header in APIs](#user-ip-header-in-apis)
      </td>

      <td>
        Forward the end user's originating IP on every call to the mentioned Transak's APIs, ensuring it matches the IP from which the user is accessing the Transak widget.
      </td>

      <td>
        `x-user-ip`

        :

        `203.0.113.42`
      </td>
    </tr>

    <tr>
      <td>
        [API Key Header in APIs](#api-key-header-in-apis)
      </td>

      <td>
        Send your partner API key from your backend on every call to all Transak's APIs.
      </td>

      <td>
        `x-api-key`

        :

        `a1d01dpa-83c0-4a55-863f-02bea44ab7e1`
      </td>
    </tr>
  </tbody>
</table>

All Transak's APIs must be called exclusively from your **backend**. Share your backend's static egress IPs with Transak to be whitelisted across both staging and production environments.

#### CORS Protection on APIs

If your platform exposes any API that internally calls a Transak API, you must apply CORS protection to that endpoint on your side. (i.e Your Backend For Frontend)

This ensures that calls flowing through your platform originate only from your own front-end domains, and not from arbitrary third-party browsers.

<table>
  <thead>
    <tr>
      <th>
        Control
      </th>

      <th>
        Recommendation
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `Access-Control-Allow-Origin`
      </td>

      <td>
        Restrict to your own front-end domains explicitly. Never use a wildcard (

        `*`

        ) as this exposes your integration to unauthorized cross-origin access.
      </td>
    </tr>

    <tr>
      <td>
        Server-to-Server Header Hygiene
      </td>

      <td>
        Your backend should never blindly forward browser-controlled headers (

        `Origin`

        , 

        `Referer`

        ) when calling Transak. Always strip or substitute them with values your backend owns and controls.
      </td>
    </tr>
  </tbody>
</table>

### Where is it Required?

CORS protection must be applied on your APIs that internally call the following Transak APIs

#### [Create Widget URL API](/api/public/create-widget-url)

Generate a secure widget URL from your backend.

#### [Whitelabel APIs](/api/whitelabel/end-points)

Integrate Transak directly through APIs without the widget.

### Why This Matters?

If an API on your side is callable from any origin, an attacker can use it to create Transak widget url that appear legitimate but carry a hijacked end user context. Origin enforcement on your side is the upstream defense that makes the infrastructure level controls effective.

#### User IP Header in APIs

Pass the **end user's originating IP address** as observed by your backend and not your backend's own IP, and not a proxy or CDN IP. Accepts a single valid IPv4 or IPv6 address.

<table>
  <tbody>
    <tr>
      <td>
        **`x-user-ip`** `string` — required

        The originating end-user IP address.

        ---
      </td>
    </tr>
  </tbody>
</table>

If you are behind a CDN, use the client IP header it injects:

| CDN                       | Header to use                                              |
| ------------------------- | ---------------------------------------------------------- |
| Cloudflare                | `cf-connecting-ip`                                         |
| Akamai, Fastly, or others | Use the equivalent client IP header from your CDN provider |

### Where is it Required?

Send `x-user-ip` on **every call** to the below mentioned Transak's APIs.

#### [Create Widget URL API](/api/public/create-widget-url)

Generate a secure widget URL from your backend.

#### [Whitelabel APIs](/api/whitelabel/end-points)

Integrate Transak directly through APIs without the widget.

**Error Handling**

| Case       | HTTP Status | Response Body                                    |
| ---------- | ----------- | ------------------------------------------------ |
| Invalid IP | `400`       | `x-user-ip` must be a valid IPv4 or IPv6 address |

### Why This Matters?

Transak uses the end user IP to pin sessions to the originating client. If a session is replayed from a different IP, it is rejected at the infrastructure level. Without a reliable user IP signal, this protection cannot be enforced, leaving sessions vulnerable to session hijacking.

#### API Key Header in APIs

Pass your **partner API key** to all Transak's APIs. Your API key is available in the [Transak Partner Dashboard](https://dashboard.transak.com).

<table>
  <tbody>
    <tr>
      <td>
        **`x-api-key`** `string` — required

        Partner API Key present in Transak Dashboard.

        ---
      </td>
    </tr>
  </tbody>
</table>

### Where is it Required?

Send `x-api-key` on **every call** to the below mentioned Transak's APIs.

#### [Create Widget URL API](/api/public/create-widget-url)

Generate a secure widget URL from your backend.

#### [Whitelabel APIs](/api/whitelabel/end-points)

Integrate Transak directly through APIs without the widget.

#### [Public APIs](/api/public/end-points)

Country/currency lookup, order tracking, and other public endpoints.

**Error Handling**

| Case                                    | Outcome          |
| --------------------------------------- | ---------------- |
| `x-api-key` header missing              | Request rejected |
| Unknown or invalid key                  | Request rejected |
| Source IP not in your partner allowlist | Request rejected |

### Why This Matters?

Transak uses your API key to verify that requests are coming from your registered backend. Each partner registers a set of static egress IPs with Transak and any request from an unrecognised IP is blocked, even if the API key is valid. This ensures your integration cannot be spoofed from outside your own infrastructure.

---

## Mandatory Checklist

To finalize these security changes, every partner must complete the [mandatory partner checklist](https://transak.link/partner-security-checklist). It collects the details Transak needs to secure and verify your integration — including your backend's **static egress IPs** to be whitelisted, and confirmation that you have implemented CORS protection, the `x-user-ip` header, and the `x-api-key` header on every call. Submitting the checklist before the deadline ensures your live integration continues without interruption.

---

## Need Assistance?

#### [Need Help?](/getting-started/help-and-support)

Contact the team and find resources to help with your integration.