FAQ

FAQ

Is my payment data sent anywhere? No. Analysis runs in your browser or in the local CLI. See Privacy and Security.

Do I need API keys or a provider account? No. PandaPayLens only reads what you paste.

Why does it say "unknown" instead of explaining my code? The code is not in the provider's public documentation, or the documentation gives several meanings. PandaPayLens shows what is documented and does not guess.

Why is a provider "limited"? Usually because the provider sends no event ids or timestamps, uses XML that is not yet supported for some responses, or lets merchants rename fields. The provider page lists the exact reasons. See Providers and Capabilities.

Detection picked the wrong provider or none at all. Choose the provider manually in the selector. If the payload is a documented format, please open a bug with the masked export.

Can it verify webhook signatures? No, by design. Pasted data can be edited, so it is always treated as unverified, and no secrets are ever requested.

Does a finding mean my integration is broken? Not necessarily. Findings point to things worth checking, with evidence and limitations. Some, like out-of-order delivery, are normal provider behavior.

My provider is not listed. Can you add it? Open a "New provider" issue with links to its official developer documentation. Providers without public documentation cannot be supported honestly.

Does PandaPayLens recommend providers for high-risk merchants? No. It is a diagnostic tool only. See High-Risk Providers.

Can I use it in CI? Yes, with the CLI and --fail-on. See Command Line Interface.

Is there an npm package? Yes, since 0.14.0: pandapaylens. Run npx pandapaylens analyze events.json, or import { analyze } from "pandapaylens" in Node.js 22 or later. See Command Line Interface.