> This page is for Cash App Pay Partner API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.cash.app/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.cash.app/_mcp/server.

# Security Requirements

## Encryption

* All Cash App Pay data stored must be encrypted at rest.
* All Cash App Pay data must be encrypted during transit.
* All communications to the Cash App Pay API must use HTTPS and TLS 1.2+.
* All communications with the Network API and Management API must provide HMAC signatures in the `X-Signature` header.

## Credentials

* API keys must be rotated automatically every 30 days.
* API keys should be scoped to the least amount of access needed to process requests. For example, if a service only needs the ability to respond to disputes, you don't need to give it permission to register new merchants.

## Refreshing QR Codes

For security reasons, the QR codes expire periodically. If this happens, a new code will be generated automatically. This is called a **Refresh**.

![QR-code-refresh.png](/_fern-img/fa6dfa40f7cb96fabae12cf9584491fbff85635e7a8c21662296de9cec835a5c.webp)

![QR-code.png](/_fern-img/94eae9394e1c2266515ae47c8e9974c580d9bac9844b5e0ad9a5a4452719072f.webp)