Merchant apps (app_key / app_secret / username / password)
Allow-list of onboarded app tuples. token/grant checks all four (username/password ride as HEADERS); business calls check x-app-key + a live id_token. Unknown app key → statusCode 2001, bad/expired token → 2079.
Payments
Initiated → (payer success + Execute) → Completed. Failure/cancel leave the payment Initiated and unexecutable (2060). Arm timeout holds the NEXT execute response past 30 s while the payment completes — the documented Query-fallback drill.
Granted tokens
id_token lifetime is tokenTtlSeconds (doc default 3600 s). Refresh rotates the pair; the old id_token stays valid until its own expiry.
Requests from the backend
Danger zone
wipes payments, logs and every runtime override — back to configured defaults