Is it safe to give my developer payment gateway access?

Connecting Razorpay, Cashfree, Stripe or PayPal to your website is part of most store builds. Owners often ask whether that means handing over payment gateway access. The safe answer: the developer needs much less than you might think, and there are proper ways to give it.

Here is what a developer needs, what to keep to yourself and how to stay in control.

What a developer actually needs

What never to share

Good payment gateway access is limited access. Keep these to yourself:

• Your main gateway login and password.
• Bank account and settlement settings.
• Payout or refund permissions, unless strictly needed.
• One-time passwords sent to your phone.

How to give payment gateway access safely

1. Use test mode first. Most gateways offer test keys so the developer can build without touching real money.
2. Use team roles. Many dashboards let you invite a user with limited permissions.
3. Enter live keys yourself if you prefer, following the developer’s instructions.
4. Rotate keys when the project ends, so old keys stop working.
5. Turn on alerts for refunds, settings changes and new team members.

Payment providers publish their own guidance; Razorpay’s pricing page also lists the products and modes available for your account type.

Why card data should never touch your server

Modern gateways handle card details on their own secure pages or fields, so your website never stores them. This keeps you out of the heaviest security requirements of the PCI Security Standards. If a developer suggests storing card numbers on your site, that is a red flag.

Example: a safe setup

A bakery’s developer built the WooCommerce checkout using Razorpay test keys. When it was ready, the owner logged in, generated live keys and pasted them into WooCommerce while on a call with the developer. The developer had a read-only team role for a month to check payment issues, then the owner removed it. At no point did the developer have payout or bank access. That is safe payment gateway access in practice.

Signs of a problem

• The developer asks for your main login or OTPs.
• Settlement details change without your request.
• Unexpected refunds or new team members appear.

If you see any of these, change passwords, rotate keys and contact your gateway’s support immediately.

Checklist when the project ends

When the store is live and stable, review payment gateway access one final time. Remove developer team members who no longer need it, rotate live API keys and update them on the site, confirm webhooks still point to the correct URL and check that alerts reach your email or phone. Keep a note of the date you made these changes. Ending payment gateway access cleanly protects you without making future support harder, because you can always invite a developer again with a limited role.

If you use more than one gateway, repeat the same steps for each account.