# Connecting a PSP

Set:

```env
PAYMENT_PROVIDER=your-psp
PAYMENT_PROVIDER_BASE_URL=https://api.psp.example
PAYMENT_PROVIDER_API_KEY=...
PAYMENT_WEBHOOK_SECRET=<strong HMAC secret>
```

Adapter contract:

- `POST /deposit-intents`
- `POST /withdrawals`
- `POST /health`

Webhook endpoint:

```text
POST /api/payments/webhook
Header: x-provider-signature: sha256=<hmac>
```

Payload must include `idempotencyKey`, `type`, `status`, `amount` and `currency`. Approved deposit webhooks credit wallet via ledger with idempotency.

No fictitious payment is accepted in production because preflight blocks `PAYMENT_PROVIDER=local`.