Authentication mistakes we still see in payment APIs

Payment APIs in Hong Kong often inherit authentication patterns from earlier product versions. Keys issued for a sandbox partner linger in production. Bearer tokens carry scopes that were never trimmed after a feature launch. Mutual TLS is documented for settlement routes but only enforced on a subset of hosts.

In audits we treat authentication as a living control, not a configuration checkbox. We ask who can mint credentials, how rotation is proven, and what happens when a partner key is revoked mid-day.

If your team cannot answer those questions with logs and runbooks, the finding is rarely a missing algorithm — it is an ownership gap that attackers and assessors both notice.