Secret keys
Allow-list of secret keys for Basic base64(`key:`) auth. An unknown key gets the documented 401 UNAUTHORIZED_KEY; an encoding without the trailing colon gets 403 INCORRECT_BASIC_AUTH_FORMAT. Defaults are the public keys from the Toss docs.
Webhook URLs (developer-center registration)
PAYMENT_STATUS_CHANGED fires on the documented transitions (unsigned; ack = HTTP 200 within 10 s, re-sends at 1/4/16/…/4096 minutes ×7). DEPOSIT_CALLBACK is the flat virtual-account event verified via the Payment `secret`.
Payments
READY → authorize (buyer authentication) → merchant confirm → DONE. Cancels go through the merchant API; the buttons here drive the widget/bank side.
Webhook deliveries (with retries)
Requests from the backend
Danger zone
wipes payments, logs and every runtime override — back to configured defaults