Partners (partnerCode / accessKey / secretKey)
Allow-list of MoMo integration credentials. Unknown partnerCode → resultCode 11 (Access denied); a signature that does not verify against accessKey+secretKey → 13 (Merchant authentication failed). secretKey signs every raw string, IPN and redirect included.
Delivery overrides
IPN/redirect targets normally come from each create request; an override forces them globally. Forced refund resultCode makes every refund answer that code (1080/1081/1088…) until cleared.
Payments
resultCode doubles as the status: 1000 = waiting for the payer. Outcomes flip the status immediately and POST the signed IPN to ipnUrl (ack = HTTP 204; undocumented upstream retry → configurable fixed interval).
Refunds (synchronous per the doc)
IPN deliveries
Requests from the backend
Danger zone
wipes payments, logs and every runtime override — back to configured defaults