Draft for legal and processing-partner review. This document is not in effect, has not been approved by counsel or any payment provider, and does not create binding obligations. Bracketed items are unresolved and are tracked in the Launch Decision Register.

API and Developer Terms

Version 0.1 — Effective date: not set

1. Scope

1.1 These terms govern access to the Orion Payments API, sandbox, webhooks, documentation and code samples (the "Developer Services"). They supplement the Merchant Services Agreement.

2. Credentials

2.1 API keys are scoped to one merchant and one environment ("test" or "live") and to specific permissions. 2.2 Secret keys are shown once. Store them securely, never in client-side code or public repositories. 2.3 You must rotate or revoke a key that may be compromised. Orion may revoke keys it believes are compromised. 2.4 Live keys cannot be issued until live activation requirements are met.

3. Permitted use

3.1 Use the Developer Services only to integrate your own approved business. 3.2 Do not exceed rate limits, attempt to access other merchants' data, reverse engineer non-public interfaces, or use the sandbox to test stolen payment data. 3.3 Return URLs must be on websites approved for your Provider Connection.

4. Sandbox

4.1 The sandbox uses synthetic data and simulated providers. Sandbox results do not guarantee live behaviour or approval.

5. Webhooks

5.1 Verify every Orion webhook signature and timestamp before acting. Process events idempotently using the event ID. Do not fulfil orders from unverified signals.

6. Changes and versioning

6.1 Breaking changes will be introduced in a new API version, with notice (proposed: at least 90 days; to be confirmed). Additive, non-breaking changes may be made at any time.

7. Availability

7.1 No uptime commitment applies to the sandbox.

8. Intellectual property and feedback

8.1 Code samples may be used and modified to integrate with Orion Payments. Feedback may be used by Orion without obligation.

9. Suspension and termination

9.1 Orion may suspend API access to protect the platform, other merchants or customers, or to comply with law or provider requirements.

10. Liability

10.1 The Merchant Services Agreement's liability provisions apply. Cap: [Liability cap for counsel review].