Security

Credentials and tokens

API keys are hashed at rest, scoped, environment-specific, and revocable. OAuth uses Authorization Code with PKCE, rotating refresh tokens, and narrow scopes. JWT verification uses cached JWKs and a five-minute clock-skew allowance.

Permissions and browser access

Scopes are least-privilege grants. CORS allows only registered browser origins and permits Authorization, Content-Type, and Idempotency-Key; credentialed cross-origin requests require an explicit origin, never *.

Transport and secrets

All public traffic requires TLS 1.2 or newer with HSTS. Service-to-service traffic uses mTLS and SPIFFE identities. Put API keys, database credentials, webhook secrets, and encryption keys in a managed secrets system; rotate application secrets every 90 days and immediately after suspected exposure.

Data protection

User data is encrypted at rest, access is audited, and exports use short-lived signed URLs. Logs must not include authorization headers, raw webhook bodies containing user data, passwords, or payment information. Report a suspected vulnerability through the support channel.