Security Best Practices

​

Credential Protection

• Store credentials securely using environment variables or a secrets manager
• Rotate credentials periodically according to your security policies
• Use separate credentials for each environment (sandbox vs production)

​

Token Management

• Store tokens securely (never in localStorage for sensitive applications)
• Implement proper expiration handling
• Never pass tokens as URL parameters
• Cache tokens on your server to minimize token requests

​

Token Refresh Strategy

// Recommended: Refresh token before expiration
const TOKEN_TTL = 60 * 60 * 1000; // 60 minutes in ms
const REFRESH_BUFFER = 5 * 60 * 1000; // 5 minutes buffer

function shouldRefreshToken(tokenIssuedAt) {
  const elapsed = Date.now() - tokenIssuedAt;
  return elapsed > (TOKEN_TTL - REFRESH_BUFFER);
}

​

Request Security

• Always use HTTPS for all API calls
• Validate and sanitize all input data
• Implement appropriate error handling
• Verify webhook signatures on incoming webhooks, if you receive any (see below)

​

Webhooks are carrier-only

​

Access Control

• Limit access to API credentials to only those who need it
• Implement the principle of least privilege
• Monitor and audit API usage
• Revoke credentials immediately when team members leave

​

Data Protection

• Minimize the amount of sensitive data transmitted
• Implement proper data retention policies
• Handle sensitive data according to regulatory requirements
• Use secure channels for sharing API credentials within your team

​

Network Security

• IP allowlisting for your API servers
• Rate limiting on your end to prevent accidental overuse
• Logging all API requests for audit purposes

​

Checklist