Payment-page browser security

Integrators embedding Watenga.js or Elements must follow these rules so card data stays inside provider-hosted fields and your page cannot be used as a tampering vector.

PCI/SAQ eligibility depends on your integration path and acquirer requirements. This guide describes Watenga's technical controls — not a compliance certification.

Allowed embed origins

Configure embedAllowedOrigins on checkout settings. Each entry is an https:// origin or a hostname (subdomains included). Elements sessions require parent_origin to match this list when it is non-empty.

Authorized scripts

Fetch the live manifest from GET /v1/public/payment-page/script-inventory. Load Watenga.js only from https://js.watenga.africa/v1/watenga.js with the integrity hash from your checkout session.

Content Security Policy

Minimum script-src allowlist for embedded checkout:

script-src 'self' https://js.watenga.africa https://*.oppwa.com;
frame-src https://*.oppwa.com https://api.watenga.africa;
connect-src 'self' https://api.watenga.africa;

Prohibited practices

Transparent overlays or fake inputs above the payment iframe
Reading DOM inside the acquirer or Watenga secure frame
Analytics or tag managers on the same document as card entry
Loading watenga.js without Subresource Integrity

See also Watenga Elements and the Watenga.js overview.