Security · 29 October 2026
Your hosts,nowhere else.
Under Developers you can now list the hosts a live payment's return and cancel addresses may point at. With a list set, Payshen refuses a live payment that would send the customer anywhere else.
The details
What changed.
Every hosted payment ends by sending the customer back to an address your backend chose. A live API key that leaks could create payments that send your customers to a page that only looks like yours. Allowed return hosts close that: list your hosts, exactly (shop.example.com) or with their subdomains (*.example.com), and a live payment whose return_url or cancel_url points anywhere else is refused with 422 return_url_not_allowed before anything else happens.
It is off until you turn it on, so no integration changes today, and test keys are never held to it. Changing the list needs two-factor authentication, like other settings, and is on your audit log.