Certificate Policy#

View as Markdown

GoCardless enforces HTTPS for all API communications using TLS. Certificates are currently provided by Google Trust Services (GTS Root R1 CA).

Verifying the Certificate#

You can verify the current certificate being served by GoCardless using the openssl command:

openssl s_client -connect api.gocardless.com:443 -showcerts

This will output the certificate chain, including the root CA.

Do not implement certificate pinning in your integration. GoCardless reserves the right to change its certificate authority (CA) or certificate at any time. If you pin the current certificate or CA, your integration will break when GoCardless updates its certificates. GoCardless will provide at least 2 weeks' advance notice on the GoCardless status page before making changes to its certificate configuration.

Change Notification#

Any changes to the certificate configuration — including changes to the CA provider — will be announced on the GoCardless status page with at least 2 weeks' notice. Subscribe to the status page to receive notifications.

What's next#

Security Requirements

Review the security requirements for accessing bank account details.

Learn more

Making Requests

Learn how to authenticate and structure API requests to GoCardless.

Learn more

Was this helpful?

Support Dashboard