Security

• Wallet payments are non-custodial. FomoPay prepares the exact transaction; the sender's own wallet signs and sends it, directly to the recipient's verified wallet. FomoPay never holds sender keys.
• Reward Vaults keep funds in your wallet. Your vault wallet (or Safe) approves FomoPay's payout signer for a capped USDG allowance. The signer can only transferFrom up to what remains of that cap — enforced by the USDG contract, not by a promise — and only to verified handles. approve(signer, 0) revokes it on-chain, any time. See Reward Vaults.
• The payout signer is isolated. In production its key is held by a managed KMS (an encrypted keyfile in local development) — never a plaintext environment variable. It holds only ETH for gas, never customer funds; payouts are serialized per signer and every one is audited.
• No smart contracts to trust. FomoPay V1 uses plain ERC-20 transfers and allowances on Robinhood Chain — no proxy, no pooled escrow, nothing to upgrade underneath you.

• Scoped. Six scopes (payments:create, payments:read, rewards:create, profiles:resolve, vaults:read, webhooks:write) — give each key only what it needs.
• Hashed. Only HMAC-SHA256(server pepper, key) is stored, plus a display prefix. Keys are shown once.
• Bound to a network. fp_test_ keys only work on the development chain, fp_live_ keys only on mainnet.
• Rate-limited and logged. Per-key limits; every request is logged without bodies or secrets; key creation and revocation are audited.
• Server-side only. Never in a browser or app bundle — the SDK refuses to run in one.

• Only VERIFIED is payable, and only VERIFIED gets a ✓. “FomoPay Ready ✓” means FomoPay verified the payout wallet: the recipient proved control of the identity and signed with the wallet. It never claims the person is “verified by Fomo”.
• Sandbox vs live. Until an authorized Fomo identity integration is switched on, identities are sandbox identities — labelled “Sandbox” in every UI, sandbox: true and a SANDBOX_IDENTITY warning in the API, and they can't receive on mainnet. FomoPay doesn't scrape Fomo or use private endpoints; everything goes through one identity adapter.
• Lookalikes are flagged. @Iyra (capital i) next to @lyra raises SIMILAR_HANDLE: people paying in FomoPay must acknowledge it before signing, and API payments carry it in warnings and risk_flags.
• Destinations are snapshotted. A payment always goes to the wallet verified when it was created. A recipient changing wallets never redirects a pending payment, and a recent change holds vault/API payouts for a cooldown (default 24 h) and warns senders for 72 h.

• /v1/resolve never returns a wallet address; payments show only a masked destination.
• No handle → wallet directory, no bulk export, no lifetime earnings. Search returns only identities that use FomoPay.
• Resolution is rate-limited per key and capped by distinct handles per day.
• Receipts default to unlisted; nothing private is published automatically.

Every payment passes the risk engine before anything is signed: recipient resolved and verified, destination still valid, asset supported, amount within per-payment / daily / project / key / recipient limits, vault able to cover it, idempotency key unused, project enabled, no open security flag, recent-wallet-change cooldown, lookalike and first-recipient checks, and approval thresholds (one or two approvers). Screening hits and blocked jurisdictions are blocked (451 COMPLIANCE_BLOCKED) or held for manual review — rules differ by country and FomoPay doesn't pretend otherwise.

Every sensitive action — payments, approvals, vault funding and withdrawal, key and team changes, limit changes, destination changes — is written to the audit log.

Every delivery is HMAC-SHA256 signed with a per-endpoint secret derived from a server key (never stored), timestamped against replay, and rotatable with an overlap window. Endpoint URLs are checked against private, loopback and metadata addresses at save time and at connect time. See signatures.

A FomoPay deployment refuses payments on Robinhood Chain mainnet unless it was explicitly switched on (MAINNET_ENABLED) after security, payment, identity and monitoring checks — the API answers 403 MAINNET_DISABLED until then. Live keys are only issued on a mainnet-enabled deployment. Development runs on a local chain with a stand-in USDG at the real USDG address, so the code paths are the ones mainnet uses.

If you believe a key, endpoint or payout was misused, revoke the key or pause the vault first (both take effect immediately), then contact the FomoPay team with the request_ids involved.