## Payments: Xaalis (Wave, Orange Money — Senegal, XOF) This project takes payments with [Xaalis](https://docs.xaalis.org). Before writing payment code, read (or use the Xaalis MCP server: `xaalis_search_docs`). - API: `https://api.xaalis.org` (live, `sk_live_…`) · sandbox: `https://sandbox-api.xaalis.org` (`sk_test_…`, fake money). Keys come from `XAALIS_SECRET_KEY` / `XAALIS_WEBHOOK_SECRET` env vars — never hard-code, log or commit them. - Amounts are **integer XOF** (`15000`), never decimals. - Every create/refund/payout sends an `Idempotency-Key` derived from our own record id; retries reuse it. - An order is paid only after a **verified** `payment.succeeded` webhook (HMAC-SHA256 over `"."`, `Xaalis-Signature: t=…,v1=…`, 300 s window, constant-time compare) or `GET /v1/payments/{id}` → `succeeded`. Never on the customer's redirect. - Test everything in the sandbox (`POST /v1/payments/{id}/simulate`) before touching live keys. Never test with live keys. - Payouts by automated code go through an agent wallet key (`ak_…`) with human-set limits, not the merchant key. MCP (for agents that support it): `npx -y @xaalis/mcp` with `XAALIS_API_KEY`, or `https://mcp.xaalis.org/mcp` with `Authorization: Bearer `. Setup per tool: . CLI: `xaalis` (`npm install -g https://docs.xaalis.org/downloads/xaalis-cli-0.1.0.tgz`), `--json` on every command. Humans to ask: contact@xaalis.org (account, going live) · security@xaalis.org (vulnerabilities, leaked keys).