Skip to main content

Getting Started

This page outlines the initial onboarding steps for banks and payment acquirers integrating with the Kesles Merchant platform as a PSP.

Confidential

Onboarding requires a signed NDA. For questions or to begin the process, contact partner@kesles.com.

1. NDA & Commercial Agreement​

Before any credentials are issued, the bank must:

  1. Sign an NDA with Kesles (covers data handling, audit, breach reporting)
  2. Agree on the commercial contract — bank code (BMRI, BRIN, BBNI, etc.), settlement window, fee model
  3. Nominate a Technical PIC and a Business PIC — these contacts are used for credential rotation and incident escalation

2. IP Allowlist​

Provide the Kesles team with the production IP range(s) that will call the Lookup API and Events API. CIDR blocks are accepted. Without an allowlist entry, all requests return 403.

Allowlist for staging is configured separately during the UAT phase — staging accepts a broader range for development convenience.

3. HMAC Credential Handover​

After NDA + allowlist are in place, Kesles will issue:

  • X-API-Key-ID (Lookup API — public identifier, safe to log)
  • HMAC secret for the Lookup API (sent via 1Password / Bitwarden — never email)
  • X-PSP-Key-ID (Events API)
  • HMAC secret for the Events API (same secure channel)

The technical PIC receives the credentials directly. Rotation cadence is 90 days with a 7-day grace window during which both old and new credentials remain valid.

4. UAT on Staging​

Before go-live, complete the test cases in Sandbox & Testing Guide. The Kesles team will sign off only after:

  • Merchant lookup by NMID and UUID return 200
  • Signature verification + timestamp freshness checks pass
  • Event forwarding (POST /psp/v1/events) returns the expected ack
  • Idempotency works (duplicate external_event_id returns {"status":"duplicate_skipped"} (HTTP 200))
  • Webhook signature verification implemented for inbound lifecycle events
  • Exponential backoff + retry implemented on the bank side for 5xx

5. Go-Live​

Once UAT is signed off, Kesles enables your production credentials. The Lookup API + Events API immediately become callable from your allowlisted IPs.

For onboarding questions: partner@kesles.com.