Preliminary Preparation / Intervention Notes

 Special Note：

Please double check the following points when receiving and sending ECPAY API notifications:

1. Make sure your server (i.e. ServerReplyURL) has already enabled the firewall (i.e. any other external IP can access your server), otherwise you will not be able to receive ECPay’s response (callbacks).
2. ECPay’s connection port for API calls is only the HTTPS (443 port). Please use a legitimate domain name system (DNS).
3. For the request method of API calls, please use HTTP POST.
4. If you really need to use a Port, ECPay supports only HTTP Port 80 and HTTPS Port 443.
5. Parameters sent to ECPay’s API should not contain any HTML tags, such us <br />, <B> or <h1> .
6. When testing API calls, please do not place credentials (i.e. MerchantID, HashKey and HashIV) into the front-end code, such as JavaScript, HTML and CSS in order to avoid the theft of credentials and data leakage.
7. Chinese characters are not supported in server URLs. Please converter the Chinese into punycode.
   • For example, 中文.tw is converted into xn--fiq228c.tw.
8. To protect customers’ rights and online transaction security, ECPay’s API services support only TLS 1.2 and above.
9. If you are calling the API too fast, you will receive an HTTP Status Code 403, so please slow down the API and wait 30 minutes before calling again.If you need to access the API at a high speed, please contact the service provider.