We will update the TLS certificates used to secure API connections to our services on May 7, 2025. 

This change is unlikely to affect you, unless you have explicitly chosen to implement certificate pinning in your HTTPS client.

Impact

Clients utilizing certificate pinning may experience connection failures or trust errors following this update.

Action required

If you're affected, we recommend discontinuing the use of certificate pinning, as it is generally discouraged. However, if this isn't possible, instructions for pinning our new certificates are provided below.

We are moving to Amazon Web Services (AWS) certificates. AWS cross-sign an intermediate certificate with different root CAs. This ensures that the certificate is trusted by a wider range of clients, especially legacy systems or older devices that may only trust a certain root. But it also means that it is not enough to add a single root certificate to trust store.

AWS provides resources for certificate pinning here: https://www.amazontrust.com/repository/ (Trust Store and Pinning Recommendations).

To recap:

1. Use public key pinning, not full certificate pinning: 
2. Pin all available root certificates found here: https://www.amazontrust.com/repository/

Testing

Testing can be performed by performing a HTTP get with the updated client to this endpoint: 

https://staging-api.reepay.com/info/

If pinning has been successfully implemented, a connection will be established, and a JSON object will be returned.

Need Help?

If you need assistance or have concerns about this change, please contact: support@frisbii.com.

Billwerk+ will deprecate support for insecure cipher suites. Affected merchants will need to upgrade their TLS library.

DEADLINE: January 6, 2025

If you are using an insecure cipher suite and do not make this update, you’ll no longer be able to use the Billwerk+ API from the deprecation date onward. Notice that is is quite unlikely that you are affected by this change, as only old HTTP client libraries does not support newer more secure ciphers.

Which cipher suites are being deprecated

On or after December 3, 2024, we will be deprecating the following two cipher suites: 

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)

This means that any client with a TLS library that uses one of these cipher suites, and does not support any of the cipher suites that will continue to be supported, will no longer be able to connect to the Billwerk+ API.

Why we are doing this

The cipher suites that we’re deprecating have a historical track record of security weaknesses. They're still vulnerable to attacks that may enable a bad actor to decrypt data. We consider this to be an unacceptable security risk, especially given our commitment to keeping our customers’ data secure.

What happens if a deprecated cipher suite is continued to be used?

If you continue to use one of the cipher suites we’re deprecating, you won’t be able to access the API. HTTP client libraries will fail to establish a TLS connection to our API. 

What cipher suites will be supported after deprecation?

We will continue to support the following cipher suites after deprecation:

• TLS 1.3 (suites in server-preferred order)
  TLS_AES_128_GCM_SHA256 (0x1301)
TLS_AES_256_GCM_SHA384 (0x1302)
TLS_CHACHA20_POLY1305_SHA256 (0x1303)
• TLS 1.2 (suites in server-preferred order)
  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)

What action should I take so that I’m not affected?

If you have a direct API integration with the Billwerk+ API:

• Ensure the TLS library you’re using supports one of the ciphers listed above

How can I test to ensure I’m using a supported cipher suite?

You can test by making a GET request to the following endpoint that only supports the cipher suites that will still be available after the deprecation of insecure suites:

https://staging-api.reepay.com/info/

If you receive a 200 OK response with JSON content, your client library is not affected by the change.

Example request with Curl

$ curl https://staging-api.reepay.com/info/
{"app.name": "CoreApiApp", ...}

• We're thrilled to announce a powerful new feature in Billwerk that enhances your flexibility: Offline Payment Methods! This new "Custom" payment method empowers you, as a merchant, to create and manage payment options that may not be natively supported by Billwerk. Whether it's bank transfers, checks, or even cash payments, you now have the tools to offer your customers these alternative methods with ease.

Key Features:

• Custom Payment Methods: If Billwerk doesn’t support a specific payment method you want to offer, you can now create it yourself. Customize everything from payment instructions to logos and currencies.
• Flexible Payment Handling: Choose whether Billwerk should automatically mark the invoice as settled upon generation, or set it to pending, allowing you to manually confirm payment once received. This flexibility ensures that you can tailor the payment process to your business needs.
• Enhanced Visibility: The payment instructions you configure will be clearly visible to your customers in both the payment window and on the PDF invoices. Additionally, the logos and payment method names will be displayed in the payment window, ensuring a seamless and professional presentation of your payment options.
• Seamless Integration: The Offline Payment Method feature is API-first, like the rest of the Optimize platform. Automate your payment confirmation process by integrating with your existing payment systems. For instance, if you receive payment data through a webhook or batch file, you can set up middleware to automatically update the invoice status in Billwerk.
  

How to Offer Offline Payment Methods to Your Customers

Once you've configured and enabled your Offline Payment Method, there are two ways to offer it to your customers:

• Enable it in the Payment Window: You can allow your customers to choose the offline payment method themselves directly in the payment window. Simply enable the option, and it will appear alongside other payment methods.
  
  
  
• Manually Add the Payment Method: Alternatively, you can manually assign an offline payment method to a customer in the Optimize Admin. This gives you the control to select the payment method that best fits the customer's needs on a case-by-case basis.
  

Important Reminder:

Remember that transactions processed through offline payment methods require manual verification, as they are not tracked by our system. This feature gives you the control to manage these transactions, whether it's for a bank transfer, check, or any other method you choose to support.

We believe this new feature will significantly enhance your payment flexibility, making it easier than ever to meet your customers’ needs.

Start exploring Offline Payment Methods today and enjoy greater control over how you manage transactions!

Hello Billwerk+ users!

We are excited to announce a new feature that will help you define the benefits associated with your plans, add-ons, and subscriptions - Entitlements!

So, what exactly are Entitlements? Simply put, they define the perks and privileges that are associated with your products and services.

This feature is perfect for businesses that offer different tiers of plans or add-ons, as you can now easily control which customers have access to which aspects of the product. It also allows for a more personalized approach to your offerings, giving your customers a tailored experience based on their needs.

As of now Entitlements can be added to your Plans, Add-Ons and Subscriptions via APIs. The ability to configure them from the front-end will be available shortly. For more information, checkout the API documentation here https://optimize-docs.billwerk.com/reference/entitlement

Exciting news! We're thrilled to announce a small but impactful addition to our Customer Portal: Single Sign-On (SSO) support! 🎉 Now, with just a simple API call using POST https://customer-portal-api.reepay.com/v1/session, along with your private key and the customer's email, you can seamlessly sign them into the portal. This means you can skip the One Time Password step, especially handy when your customer is already logged into your environment. Enjoy the smoother, hassle-free experience!

If you are using webhooks and use IP whitelisting for the reception of webhooks, this is important to you. We are making an infrastructure change which means that from April 2nd, webhooks can also come from IP 34.247.100.100, in addition to the existing IP 52.18.114.235.

Feel free to reach out if you have any questions.

We have been talking about this for far too long, but we are thrilled to announce that the initial version of our new hosted pages is finally complete 🤩 

We have also introduced hosted page products to provide you with enhanced configuration options. These products are specifically designed for customization within your hosted pages. Once you have configured multiple products, you can seamlessly integrate them into your hosted page.

In just a matter of minutes, you can effortlessly create these hosted pages and obtain a distinct link that directly navigates to your hosted page. This link can be easily incorporated into a button on your website or blog, included in your newsletter, inserted within your Facebook group or Instagram page, or even transformed into a QR code. The possibilities are endless, limited only by your imagination. With this convenience, you have the freedom to sell your subscriptions anywhere you desire.

When setting up a hosted page product, you have the flexibility to modify various aspects that influence both the product's appearance and the customer's purchasing experience. For instance, you can manage the name, description, icons, benefits, fields, and more, determining how your products are showcased in the hosted page product catalog and during the hosted page checkout process. Additionally, you can create a product that includes not only a plan but also several add-ons and additional costs. This means that when a customer purchases this product, they will be subscribed for all associated elements simultaneously.

Once you have created your hosted page products, seamlessly integrating them into your hosted page becomes a breeze. Moreover, you have the flexibility to create multiple hosted pages as needed. Within these hosted pages, you can assign a name, an acceptance URL, and a cancel URL. The acceptance URL directs customers after a successful subscription sign-up, while the cancel URL guides them in the event of a change of mind. Additionally, you can specify the language for your hosted page, select an accent color that complements your brand, define the accepted payment methods for customers, and determine the product lineup and its presentation order within your hosted page.

If you should be in doubt about something when you create your hosted pages and hosted page product, you can find tooltips on all elements on your configuration pages.

To assist in the construction of Checkout API requests, Reepay has just launched the Checkout Helper.

https://checkout-helper.reepay.com/

The helper provides an interactive tool to construct and test Checkout API requests before implementing them.

Cheers, Reepay