Attestly Developer and API Terms

1. About these Terms

1.1 These Developer and API Terms (these "Terms") govern your use of the Attestly application programming interfaces, software development kits, sample code, documentation, the sandbox, webhooks, the Attestly WooCommerce plugin and any other developer tools we provide (together, the "Developer Tools"). Attestly LLC, a Wyoming limited liability company ("Attestly", "we", "us" or "our"), provides them.

1.2 "You" means the business that holds the Attestly account used to access the Developer Tools, and the individual who accepts these Terms on its behalf. If you accept these Terms for a business, you confirm you have authority to bind it.

1.3 You accept these Terms by clicking to accept them (the box is never checked in advance), which we ask you to do before you create your first Key or connect the plugin, and your acceptance is recorded as described in the Merchant Terms. Once your account is under the Merchant Terms or another Account Agreement, creating Keys, installing the plugin or calling the API also means you accept them. If you do not agree, do not use the Developer Tools.

1.4 These Terms add to, and are part of, the agreement that governs your Attestly account: the Attestly Merchant Services Agreement (the "Merchant Terms") and, if you are a platform, the Attestly Connect Platform Agreement, and if you are an Agent, your Agent Agreement (each, your "Account Agreement"). If these Terms conflict with your Account Agreement about the Developer Tools, these Terms control. On everything else, including fees, reserves, holds, disputes, liability and dispute resolution, your Account Agreement controls. Capitalized terms not defined here have the meanings in your Account Agreement.

2. Definitions

• "API" means Attestly's application programming interfaces.
• "Your Application" means any website, store, app, system or code you build or run that connects to the Developer Tools.
• "Keys" means all credentials we issue for API access, including Secret Keys, Restricted Keys, Read-only Keys, Publishable Keys, and Webhook Signing Secrets.
• "Secret Key" means a Key with full access to your account in the mode it was created for (live or test).
• "Restricted Key" means a Key you create with only the permissions you select.
• "Read-only Key" means a Restricted Key that can read data but cannot create, change, move or delete anything.
• "Publishable Key" means a Key meant to be used in browsers or apps to collect payment details through our hosted fields. It cannot read account data or move money.
• "Webhook" means a notice we send to an endpoint you register when an event happens on your account.
• "Webhook Signing Secret" means the secret we use to sign Webhooks sent to an endpoint.
• "Live Mode" means use of the Developer Tools that creates real transactions and moves real funds.
• "Test Mode" or "Sandbox" means use of the Developer Tools with test Keys that does not move real funds.
• "Plugin" means the Attestly WooCommerce plugin and its updates.
• "Account Data" means data about your account, your transactions and your customers that you get through the Developer Tools.
• "Losses" means losses, liabilities, damages, Chargebacks, refunds, reversals, negative balances, Fines and Assessments, costs and reasonable attorneys' fees.

3. License to use the Developer Tools

3.1 Subject to these Terms and your Account Agreement, we give you a limited, revocable, non-exclusive, non-transferable, non-sublicensable license to use the Developer Tools during the term of your Account Agreement, only to connect Your Application to your own Attestly account (or, for Connect Platforms and Agents, to the accounts your Account Agreement allows) and only to accept payments and manage your account as the Services allow.

3.2 We and our licensors own the Developer Tools and all related intellectual property. Except for the license in Section 3.1 and the open-source license in Section 10.2, we grant no rights. All rights not expressly granted are reserved.

3.3 Some Developer Tools include open-source components. Those components are governed by their own licenses, which control to the extent they conflict with these Terms.

4. API Keys

4.1 Secret Keys are shown once. When you create a Secret Key or Restricted Key, we display the full Key one time. We store only a protected form of it and cannot show it to you again. If you lose it, you must create a new Key and retire the old one.

4.2 Use the least access you need. Use a Restricted Key or Read-only Key, limited to the permissions Your Application needs, wherever possible. Use Secret Keys only on servers you control. Use Publishable Keys, never Secret or Restricted Keys, in browsers, mobile apps or any code a user can see.

4.3 Your security duties. You must:

(a) keep Keys confidential and store them in a secrets manager or encrypted configuration, not in source code, code repositories, client-side code, chat messages, tickets, email or screenshots;

(b) limit access to Keys to the people and systems that need it, and remove access promptly when a person leaves or a system is retired;

(c) not share Keys with anyone outside your business, except a service provider building or running Your Application for you, who you make bound by duties at least as strict as these and for whom you are responsible;

(d) use separate Keys for separate systems where practical, so one can be revoked without stopping the others;

(e) protect the accounts and devices used to sign in to your dashboard, including by using multi-factor authentication; and

(f) rotate Keys periodically and whenever a person with access to them leaves.

4.4 Duty to rotate and report on exposure. If you know or suspect that a Key has been exposed, lost, stolen or used without authorization (for example, it was committed to a public repository, pasted into a chat or ticket, or logged in plain text), you must:

(a) immediately revoke or roll the Key in your dashboard and update Your Application;

(b) notify us at security@useattestly.com as soon as possible and no later than 24 hours after you learn of it; and

(c) cooperate with our investigation and give us the information we reasonably request.

4.5 Our right to revoke. We may revoke, roll, restrict or expire any Key at any time, without prior notice where we reasonably believe it is needed to protect you, your customers, Attestly, our payment processors or sponsor banks, including if we find a Key exposed in public or see activity that looks unauthorized. We will tell you promptly after we act. We are not responsible for downtime caused by revoking a Key we reasonably believed was at risk.

4.6 Responsibility for activity on your Keys. You are responsible for all activity carried out using your Keys and your dashboard credentials, including refunds, transfers, payouts, changes to payout accounts and data access, whether or not you authorized it, and for any resulting Losses. This does not apply to activity or Losses to the extent caused by (a) a breach of Attestly's own systems, or (b) use of a Key after you revoked it in your dashboard or after we confirmed receipt of your report under Section 4.4 and had a reasonable time (not more than 4 hours) to act on it.

4.7 Changes to sensitive settings. For your protection, we may require a second sign-in factor (for example a code from an authenticator app) before you create or reveal a Key, change Key permissions, add a Webhook endpoint, or change a payout bank account or owner details, and we may apply a delay or hold payouts after such a change, as described in the Merchant Terms.

4.8 Gateway credentials you connect. If you connect a payment gateway account that you hold with another provider (for example by entering its login, API keys or transaction keys), you confirm that your agreement with that provider allows you to let us use them, and you authorize us to store them encrypted and to use them only to provide the Services you request, such as submitting and managing your transactions and reading their status. We never display them back to anyone in full. You may disconnect them at any time in your dashboard, which ends our use of them, and you should also roll them with the provider. That provider, not Attestly, is responsible for its own service, fees, settlement and holds, and Section 3.9 of the Merchant Terms applies.

4.9 Test and live Keys are separate. Test Keys work only in Test Mode and cannot create live transactions. Live Keys must never be used in a test or development environment, or given to anyone who does not need live access.

5. Rate limits and fair use

5.1 We set limits on the number and rate of API requests, the size of requests and responses, and concurrent connections ("Rate Limits"). Rate Limits may differ by endpoint, account, mode and risk level. Current published limits are in our documentation. We may change them, and will give notice of material reductions to published limits except where needed for security or stability.

5.2 If you exceed a Rate Limit, we may reject requests (for example, with an HTTP 429 response), slow them, or temporarily block them. Your Application must handle these responses and retry with exponential backoff.

5.3 You must not try to get around Rate Limits, for example by spreading requests across multiple accounts or Keys, or by creating accounts to get more capacity.

5.4 If you need higher limits, contact us. We may agree in writing, and may charge for it.

5.5 You must not load-test, stress-test or performance-test the live API without our prior written approval. Use the Sandbox for testing, within its limits.

6. Webhooks

6.1 Endpoints. You may register endpoints to receive Webhooks. Endpoints must use HTTPS with a valid certificate. You are responsible for your endpoints and the systems behind them.

6.2 Signing secrets. Each endpoint has a Webhook Signing Secret. We sign each Webhook so you can confirm it came from us. You must:

(a) verify the signature on every Webhook, using the method in our documentation, before acting on it;

(b) reject Webhooks with invalid signatures or timestamps outside the tolerance in our documentation, to prevent replay; and

(c) protect Webhook Signing Secrets as you protect Secret Keys, and roll them under Section 4.4 if exposed.

6.3 Delivery is not guaranteed in order or only once. Webhooks may arrive late, more than once, or out of order. Your Application must process them idempotently (handling the same event twice must not cause a double effect, such as shipping an order twice). If your endpoint does not return a success response, we will retry on a declining schedule for up to 3 days, after which we may stop.

6.4 Webhooks are notices, not the record. The authoritative status of a payment, refund, dispute, payout or account is what the API returns when you retrieve the object. Before you take an irreversible step that depends on a payment (for example, shipping goods or releasing a digital product), confirm the status through the API. We are not liable for Losses caused by relying on a Webhook alone, by failing to verify a signature, or by an endpoint that was down or misconfigured.

6.5 Disabling endpoints. We may disable an endpoint that repeatedly fails, responds too slowly, or puts our systems at risk, and will tell you when we do.

6.6 What Webhooks carry. Webhook payloads identify objects and events. They never contain full card numbers, card security codes, full bank account or routing numbers, or government identification numbers. Retrieve details you are allowed to see through the API.

7. Acceptable use

7.1 You must not, and must not let anyone else:

(a) use the Developer Tools for a business, product or purpose that your Account Agreement or our policies prohibit, or that has not been approved for your account;

(b) access, or try to access, data or accounts you are not authorized to access, including other merchants' data;

(c) scrape, crawl, or use bots or automated means to extract data from our dashboard, websites, or documentation, or use the dashboard in an automated way instead of the API;

(d) interfere with, disrupt, overload, or attack the Developer Tools or our systems, including through denial-of-service attacks, malware, or attempts to bypass security, authentication, Rate Limits or risk controls;

(e) reverse engineer, decompile or disassemble any part of the Services that is not provided to you in source form, except to the extent applicable law permits this despite this restriction;

(f) sell, resell, lease, sublicense or provide access to the Developer Tools or your Keys to third parties, or use them to provide payment services to other businesses, except as a Connect Platform or Agent under a signed or accepted agreement with us that allows it;

(g) send us full card numbers, security codes or full bank account numbers through any field or endpoint not designed to receive them;

(h) store, process or transmit card data outside our hosted fields and tokenization unless you are PCI DSS compliant and give us proof of compliance on request;

(i) use Account Data for any purpose other than operating your business and Your Application, or sell or share it in violation of law or our Privacy Policy;

(j) build or train a product that copies the Developer Tools, or use the Developer Tools or our documentation to build a competing payment service;

(k) misrepresent your identity or your relationship with Attestly, or suggest that Attestly endorses Your Application; or

(l) use the Developer Tools in violation of any law, card network rule, or the requirements of our payment processors or sponsor banks.

7.2 You are responsible for Your Application, including its security, its compliance with law, its privacy notice to your customers, and the accuracy of the information it sends us.

8. Security research

8.1 If you find a security vulnerability in our Services, report it to security@useattestly.com and give us a reasonable time to fix it before disclosing it.

8.2 We will not pursue legal action against good-faith research that: stays within your own accounts and test data; does not access, change or delete other people's data; does not degrade our Services; does not use social engineering, phishing or physical attacks; and is reported to us promptly and kept confidential until we fix it. This safe harbor does not authorize testing of our payment processors', sponsor banks' or other third parties' systems.

9. Sandbox and Test Mode

9.1 Use test Keys and the Sandbox to build and test Your Application. Use only the test card numbers and test bank accounts in our documentation. Never enter real card numbers or real bank account information in Test Mode.

9.2 Test Mode does not move real money and has no service level. Test data may be limited, reset or deleted at any time. Test Mode behavior may not match Live Mode in every way.

9.3 Access to the Sandbox, or success in Test Mode, does not mean your account will be approved for Live Mode, for any product, or at any limit. Live Mode access is subject to underwriting and approval under your Account Agreement and may be withdrawn as it describes.

9.4 Do not use the Sandbox for production traffic, load testing beyond published limits, or any purpose other than development and testing.

10. The WooCommerce Plugin

10.1 What it does. The Plugin connects a WooCommerce store to your Attestly account so the store can accept payments, receive status updates and display required information.

10.2 Code license. The Plugin's code is licensed to you under the GNU General Public License, version 2 or (at your option) any later version (the "GPL"), as stated in the Plugin's files. Nothing in these Terms limits the rights the GPL gives you in the Plugin's code. These Terms govern your access to the Services through the Plugin, your Keys, our trademarks, and our support and updates.

10.3 Access requires an account. The Plugin works only with valid Keys for an approved Attestly account. Copying or modifying the Plugin does not give you a right to use the Services.

10.4 Modified versions. If you modify the Plugin, you are responsible for your changes and any Losses they cause. We do not support modified versions, and you must not distribute a modified version under the Attestly name or logo, or in a way that suggests it is ours or approved by us.

10.5 Updates and minimum versions. We may release updates for security, compliance, card network rule changes and new features. You must keep the Plugin updated. We may set a minimum supported version and may stop accepting requests from older versions after notice, or immediately if an older version has a security issue. The Plugin installs our updates automatically by default where WordPress allows. You can turn this off by adding a short line of code to your site, which we will send you on request, but you must still keep the Plugin updated.

10.6 Your store. You are responsible for your WordPress and WooCommerce installation, hosting, other plugins and themes, backups, and the security of your admin accounts. Conflicts with other plugins or themes, or changes to WordPress or WooCommerce, may affect the Plugin. You must test updates on a staging site where possible.

10.7 Diagnostics. The Plugin sends us the information described in our Privacy Policy (for example store URL, versions, configuration status and error information) so we can operate, secure and support it.

10.8 Trademarks. We grant you a limited, revocable license to display the Attestly name and logo in your store only to show that you accept payments through Attestly, following our brand guidelines. You may not use our marks in a domain name, product name or in any way that suggests a partnership or endorsement we have not agreed to in writing.

11. Changes to the Developer Tools

11.1 We may change, add or remove features of the Developer Tools at any time.

11.2 We version the API. For a breaking change to a generally available API version (a change that requires you to change working code), we will give at least 90 days' notice, except where a shorter period is needed for security, to prevent fraud or loss, or to comply with law, card network rules or the requirements of our payment processors or sponsor banks. Beta and preview features may change or end at any time without notice.

11.3 You are responsible for keeping Your Application compatible with supported API versions.

12. Suspension and termination

12.1 We may suspend or limit your access to any or all of the Developer Tools, revoke Keys, disable Webhook endpoints, or block the Plugin from connecting, with or without prior notice, if we reasonably believe:

(a) you have breached these Terms or your Account Agreement;

(b) your use creates a security risk, harms or threatens our systems or other users, or is abusive (including scraping, Rate Limit evasion or attacks);

(c) your Keys or account may be compromised;

(d) it is needed to prevent fraud, financial crime or Losses; or

(e) law, card network rules, or a payment processor or sponsor bank requires it.

We will give notice before acting where it is practical and lawful, and otherwise promptly after. We will restore access when the reason for the suspension ends, if it does.

12.2 These Terms end when your Account Agreement ends. When they end, your license ends, your Keys stop working, and you must stop using the Developer Tools. The GPL license to Plugin code you already received continues under the GPL's own terms.

12.3 Suspending your API access does not by itself change your obligations or our rights under your Account Agreement, including for refunds, disputes, chargebacks, reserves and amounts owed.

12.4 Sections 4.6, 6.4, 7, 13 to 17 and any other terms that by their nature should survive will survive.

13. Changes to these Terms

We may update these Terms. We will post the new version with a new effective date. For a material change that is adverse to you, we will give at least 30 days' notice by email or in the dashboard, except where a shorter period is needed for security, fraud prevention or legal compliance. Your continued use of the Developer Tools after a change takes effect means you accept it. If you do not agree, you must stop using the Developer Tools.

14. Feedback and confidentiality

14.1 If you send us suggestions or feedback, we may use them without restriction or payment to you.

14.2 Non-public parts of the Developer Tools, including beta features, non-public documentation and any information we mark as confidential, are our Confidential Information under your Account Agreement. You may not disclose them or use them except to build and run Your Application.

15. Disclaimers

15.1 THE DEVELOPER TOOLS, THE SANDBOX, SAMPLE CODE AND THE PLUGIN ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT THE LAW ALLOWS, ATTESTLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND THAT THE DEVELOPER TOOLS WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE, OR WILL WORK WITH ANY OTHER SOFTWARE.

15.2 Sample code is for illustration. You are responsible for testing and securing any code you use.

15.3 Nothing in this Section limits any warranty that cannot be excluded under applicable law.

16. Limitation of liability and indemnity

16.1 The limitations of liability in your Account Agreement apply to the Developer Tools.

16.2 In addition, and to the fullest extent the law allows, Attestly is not liable for any Losses arising from: Your Application; your failure to secure Keys or Webhook Signing Secrets or to rotate them under Section 4.4 (subject to Section 4.6); your failure to verify Webhook signatures or to confirm status through the API; acting on a Webhook alone; your endpoints or hosting; modified versions of the Plugin; conflicts with third-party plugins, themes or software; or your use of the Sandbox.

16.3 If your Account Agreement does not set a cap for a claim arising from the Developer Tools, Attestly's total liability for all such claims is limited to the greater of (a) the fees you paid Attestly in the 3 months before the event giving rise to the claim, and (b) US $100.

16.4 Nothing in these Terms limits liability for fraud, gross negligence or willful misconduct, or any liability that cannot be limited under applicable law.

16.5 You will defend, indemnify and hold harmless Attestly, its members, managers, employees, agents, payment processors and sponsor banks from Losses arising from Your Application, your breach of these Terms, misuse of your Keys (subject to Section 4.6), or your violation of law or third-party rights, as further described in your Account Agreement.

17. General

17.1 Export and sanctions. You must comply with U.S. export control and sanctions laws. You may not use the Developer Tools in, or for the benefit of anyone in, a country or region subject to comprehensive U.S. sanctions, or anyone on a U.S. government restricted-party list.

17.2 Governing law and disputes. These Terms are governed by the governing-law and dispute-resolution terms of your Account Agreement. If your Account Agreement has none, these Terms are governed by the laws of the State of Wyoming, without regard to conflict-of-laws rules, and disputes will be resolved under the arbitration and class-action-waiver terms of the Merchant Terms.

17.3 Severability. If any part of these Terms is held invalid or unenforceable, that part will be enforced to the maximum extent allowed and the rest of these Terms will remain in effect.

17.4 Assignment. You may not assign these Terms without our written consent. We may assign them to an affiliate or successor, or as part of a merger, acquisition or sale of assets.

17.5 No waiver. Our failure to enforce a provision is not a waiver of our right to do so later.

17.6 Notices. We may give notices by email to your account contact or in the dashboard. You must send legal notices to legal@useattestly.com and to our mailing address, and security reports to security@useattestly.com.

17.7 Entire agreement. These Terms, your Account Agreement, our Privacy Policy and the documentation referenced in them are the entire agreement about the Developer Tools.

Contact

Attestly LLC
75 E 3rd St, Ste 7, Sheridan, WY 82801
Developers: developers@useattestly.com
Security: security@useattestly.com
Legal notices: legal@useattestly.com