> ## Documentation Index
> Fetch the complete documentation index at: https://darwin.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Pay best practices

> Keep payment authority bounded, tokenized, idempotent, and separate from authentication.

## Trust the bound interaction

Read amount, currency, merchant, protocol, scope, and expiry from the current payment interaction. Do not let a model or client override those terms in the payment request.

## Keep credentials out of the Action

* Never put raw card details, bank credentials, wallet keys, payment tokens, or checkout secrets in prompts or Action updates.
* Use first-party `webLink` flows after a user gesture when sensitive input is required.
* Store processor-tokenized references rather than card data when the user explicitly saves a method.
* Keep authentication and payment authority as separate decisions.

## Make retries idempotent

Use one stable `requestId` for the same payment attempt. After a timeout, read the same Action before retrying so the client cannot create a duplicate charge or replacement Action.

## Confirm from server state

A redirect, closed checkout window, wallet signature, or provider response displayed in the client is not the final authority. Continue reading the same `actionId` until Darwin reports the backend-confirmed state.

## Test payment-specific failures

Test changed terms, expired checkout, duplicate submission, decline, insufficient balance, abandoned browser flow, processor timeout, and a successful charge followed by delayed Action confirmation.