​

Connections (BYOK)

​

💎 The BYOK Advantage

​

🏢 For Business Strategy

• Direct Settlement: Funds are settled directly into your own PSP accounts. Reevit never touches your money.
• Better Rates: Negotiate your processing fees directly with providers based on your volume. We don’t add markups to your transaction costs.
• Zero Lock-in: Your data and customer payment tokens belong to you. If you choose to stop using Reevit, your provider accounts remain active.
• Unified Security: Store all your API keys in one encrypted Vault instead of scattering them across multiple service environments.

​

💻 For Engineering Control

• Abstracted Credentials: Manage multiple keys for different regions (e.g., Paystack Ghana vs. Paystack Nigeria) under a single connection_id.
• Capability Mapping: Reevit automatically knows which connection to use based on the currency and method in the payment request.
• Health Monitoring: Every connection has a real-time health score. If a provider’s API starts failing, Reevit detects it and shifts traffic to your fallbacks.

​

🛠️ Setting Up a Connection

​

1. Collect your PSP Keys

​

2. Register the Connection

import { Reevit } from '@reevit/node';

const connection = await reevit.connections.create({
  id: 'paystack_gh_primary',
  provider: 'paystack',
  mode: 'live',
  credentials: {
    secret_key: 'sk_live_xxx',
    public_key: 'pk_live_xxx'
  },
  capabilities: {
    methods: ['card', 'mobile_money'],
    countries: ['GH']
  }
});

​

🌍 Supported Ecosystem

​

📋 Field Reference

​

Understanding labels

• Routing Hints: Tag connections as primary or fallback to influence failover behavior.
• Regional Grouping: Use labels like ghana, nigeria to logically group connections by market.
• Custom Segmentation: Apply any label that makes sense for your business, such as high-volume or testing-only.

// Example: Creating a connection with labels
await reevit.connections.create({
  id: 'hubtel_gh_fallback',
  provider: 'hubtel',
  mode: 'live',
  credentials: { client_id: '...', secret: '...' },
  labels: ['fallback', 'ghana', 'momo-only']
});

​

🔒 Credential Security

​

Encryption at Rest

• Credentials are encrypted immediately upon receipt
• Key custody is deployment-specific; request the applicable controls through the Trust Center
• Read APIs do not return stored secret credentials

​

Credential Access

1. Processing a payment that routes to this connection
2. Testing the connection via the test endpoint

​

Security Best Practices

1. Use separate credentials per environment
   // Sandbox - never use test keys in production
   await reevit.connections.create({
     id: 'paystack_sandbox',
     mode: 'sandbox',
     credentials: { secret_key: 'sk_test_...' }
   });
   
   // Production - use live keys only
   await reevit.connections.create({
     id: 'paystack_live',
     mode: 'live',
     credentials: { secret_key: 'sk_live_...' }
   });
   
2. Never expose credentials in logs or error messages
   • Reevit automatically masks credentials in logs
   • Never print credentials to console in your application
3. Rotate credentials regularly
   • Most PSPs allow key rotation without service interruption
   • Update credentials via the API when rotating:
   await reevit.connections.update('paystack_live', {
     credentials: { secret_key: 'sk_live_new_key...' }
   });
   
4. Use webhook secrets for signature verification
   await reevit.connections.create({
     provider: 'stripe',
     credentials: {
       secret_key: 'sk_live_...',
       stripe_webhook_secret: 'whsec_...'  // For webhook verification
     }
   });
   

​

✅ Best Practices

1. Redundancy is Key: Always have at least two connections for your primary market (e.g., Hubtel + Paystack for Ghana). This enables Smart Routing.
2. Environment Matching: Ensure your mode (live/sandbox) matches the PSP keys you are using.
3. Regular Rotation: Rotate your provider secret keys every 90 days as part of your security protocol. Reevit makes this seamless via the update API.

​

📚 Related Resources