Save this content to: .claude/skills/protect/SKILL.md

# Endpoint Protection and Security

Protect payment return endpoints against unauthorized token reuse, brute-force requests, and replay attacks. The package automatically saves newly issued transaction and registration tokens in cache for 5 minutes, and the `transbank.protect` middleware verifies and consumes them atomically upon return.

## Enabling token cache protection

Enable endpoint protection in `config/transbank.php` instead of creating custom token verification tables or listeners, because the package registers `SaveTransactionToken` to automatically cache tokens for 300 seconds whenever `TransactionCreated` or `RegistrationStarted` events fire.

```php
// config/transbank.php
return [
    'environment' => env('TRANSBANK_ENV', 'integration'),

// Configure cache-based protection for issued tokens.
    'protect' => [
        'enabled' => env('TRANSBANK_PROTECT_ENABLED', true),
        'store' => env('TRANSBANK_PROTECT_CACHE', 'redis'),
        'prefix' => 'transbank|token',
    ],
];
```

Verification: Every token generated by `Webpay::create()` or `Oneclick::register()` is saved to the designated cache store with a 5-minute TTL.

## Securing callback routes with transbank.protect middleware

Apply the `transbank.protect` middleware alias to your payment and registration return routes instead of validating token existence manually in controllers, because the middleware pulls and deletes the token from cache atomically, returning HTTP 404 if the token is missing, expired, or previously consumed.

```php
use App\Http\Controllers\PaymentConfirmationController;
use App\Livewire\PaymentStatus;
use Illuminate\Support\Facades\Route;
use Laragear\Transbank\RouteRedirect;

// Protect standard controller payment confirmation.
Route::get('checkout/confirm', PaymentConfirmationController::class)
    ->name('payment.confirm')
    ->middleware('transbank.protect');

// Protect Livewire payment confirmation component.
Route::get('checkout/status', PaymentStatus::class)
    ->name('payment.status')
    ->middleware('transbank.protect');

// Pair with RouteRedirect to ensure failed POST transactions also pass through smoothly.
RouteRedirect::as('checkout/confirm');
```

Verification: The request succeeds only if the incoming token was generated by the application within the last 5 minutes. Subsequent attempts with the same token fail with an HTTP 404 response.

## Configuring production environments and credentials

Configure the environment and API credentials using `.env` variables instead of modifying config defaults directly, because the package ships with official Transbank integration credentials out of the box and requires explicit production designation to switch endpoints.

```dotenv
# .env

# Set to 'production' to switch from Transbank test servers to live servers.
TRANSBANK_ENV=production

# Production credentials provided by Transbank for each service.
WEBPAY_KEY=597012345678
WEBPAY_SECRET=your_production_secret_key_here

ONECLICK_KEY=597012345679
ONECLICK_SECRET=your_production_secret_key_here
```

Verification: When `TRANSBANK_ENV=production`, Webpay and Oneclick requests target live Transbank production servers using your production credentials.