Which settings can I change myself?
The pattern behind the table: anything that is part of your commercial agreement or a
channel-side registration is configured by Waffo and read by you; anything that is your own
integration surface is yours. The sandbox is the exception that catches people out — it is fully
self-serve, which makes it easy to assume production is too.
Can I enable a payment method or a country myself?
Not for live payments. Enabling a method in the sandbox setup wizard configures what you can test against; what you can accept is a payin agreement, created on Waffo’s side, and it is the only thing that governs a real payment. So the two lists can differ, and that is the single most common go-live surprise:
To add a method or a country to your live account, ask your Waffo contact. What that involves and
how the request progresses is in Payment Enrollment.
Can I add or change my settlement bank account myself?
No. Settings → Bank Accounts is a read-only list of the accounts already set up for you, showing the account currency, the account name and number, the bank name, the SWIFT code and the bank address. There is no add, edit or delete control, so a new or corrected account goes through your Waffo contact. Check that page first when a withdrawal is going somewhere unexpected — what it shows is what withdrawals use. Which account a withdrawal targets and why the button may be disabled are in Withdrawals & Batch Payouts.Can I restrict API access to my own servers myself?
Yes, and this is one of the few security controls that is fully self-serve. Settings → IP Whitelist lets you add entries, enable and disable them individually, and turn the whole feature on or off. The check runs after signature verification, so a request with a good signature from an unlisted address is still refused. Treat the first entry with care: once the allowlist is enabled, requests from any address not on it are blocked immediately. Formats, entry limits, the enforcement modes and what happens when the source address cannot be determined are in Portal Security Configuration.Can I add or rotate my keys myself?
Yes. Your API key is visible on Settings → Integration, and you submit and rotate your own public key from the same place. In the sandbox the private key is shown to you as well, because the sandbox key pair is pre-generated; in production it never is — you generate the pair and keep the private half. The full mechanics — what the field accepts, why submission asks you to sign a challenge string, the three operation types, and how to rotate without downtime — are in Production API Keys & Public Keys. Generating a production pair is in the published Go-live checklist.Can I register a domain myself?
There is no domain screen in the Portal, so no. Two cases come up, and both go through technical support:
If you change the domain your checkout is served from, treat it as a change with several
dependencies rather than one setting: your notification URL and redirect URLs, your IP allowlist if
your egress changed with it, and any wallet domain registration all have to follow. Raise the change
before you cut over rather than after.
Can I change how long an order stays payable?
Partly. You passorderExpiredAt on order creation, and it controls how long the customer has to
submit the payment on the checkout page. Once the order has gone to the payment method, the expiry
belongs to that method.
What you cannot do is edit the per-method expiry configuration: Service → Payin has an Order
Expiry Customization column that appears where the row supports one, and it is read-only
everywhere in the Portal. Only a small number of payment methods accept a channel-side expiry at
all — read that column rather than assuming. The field rules are in the published
FAQ, and how long an unpaid order actually
stays open is in Payment Timeouts & Finality.
Can I turn 3DS off?
There is no account-level 3DS switch and no Portal screen for it. What exists is a per-request preference you send on order creation,threeDsDecision inside the card information, and it is a
preference rather than a switch — risk and the issuer sit above it, and it does nothing on payment
methods other than cards and card-backed wallets, or on merchant-initiated charges.
Full treatment — the accepted values, the order of precedence above them, and why an authentication
step can still appear after you asked to skip it — is in
Risk Declines & 3D Secure. What it is not is a lever on
approval outcomes; declines and what to do about each class are in
A card was declined. Should I retry?.
Can I permanently hide a payment method from the checkout?
There is no account-level “hide” switch. What you have is two different levers:
Per-order narrowing has an asymmetry worth knowing before you rely on it: passing a country hides
other countries’ local methods but keeps globally available ones. Both levers, and the layout
forms that need an account manager, are covered in
Cashier Display Rules and
Cashier Customization.
Can I take a payment without writing any code?
Yes — create a payment link in Transactions → Payment Link and send it to your customer. You choose the product, country, order currency and amount, and optionally an expiry; the link’s paid state is tracked in the same list. Details, including the default expiry and how the resulting transactions appear, are in Payment Links.What can I check myself instead of asking?
Most “is it me or is it you?” questions have a self-serve answer:
There is no separate public status page. The availability fields on the payment-method
configuration endpoint are the self-serve equivalent, and order creation is always the final
authority on whether a method can take a payment.