Register the PSP's own onboarding public key and HTTPS webhook. The server generates its acknowledgement key and webhook secret. These are displayed once after registration.
A webhook update rotates its HMAC secret. An onboarding key update invalidates outstanding QR tokens. Coordinate each change with the PSP.