https://oxapay.com/blog/zh/payment-api-security-best-practices-for-api-key-security/