Skip to main content
To ensure the security of your integration, follow these best practices:

ā€‹
Credential Protection

Never expose your clientId or clientSecret in frontend code.
  • Store credentials securely using environment variables or a secrets manager
  • Rotate credentials periodically according to your security policies
  • Use separate credentials for each environment (sandbox vs production)

ā€‹
Token Management

  • Store tokens securely (never in localStorage for sensitive applications)
  • Implement proper expiration handling
  • Never pass tokens as URL parameters
  • Cache tokens on your server to minimize token requests

ā€‹
Token Refresh Strategy

// Recommended: Refresh token before expiration
const TOKEN_TTL = 60 * 60 * 1000; // 60 minutes in ms
const REFRESH_BUFFER = 5 * 60 * 1000; // 5 minutes buffer

function shouldRefreshToken(tokenIssuedAt) {
  const elapsed = Date.now() - tokenIssuedAt;
  return elapsed > (TOKEN_TTL - REFRESH_BUFFER);
}

ā€‹
Request Security

  • Always use HTTPS for all API calls
  • Validate and sanitize all input data
  • Implement appropriate error handling
  • Use webhook signature verification for incoming webhooks

ā€‹
Access Control

  • Limit access to API credentials to only those who need it
  • Implement the principle of least privilege
  • Monitor and audit API usage
  • Revoke credentials immediately when team members leave

ā€‹
Data Protection

  • Minimize the amount of sensitive data transmitted
  • Implement proper data retention policies
  • Handle sensitive data according to regulatory requirements
  • Use secure channels for sharing API credentials within your team

ā€‹
Network Security

For additional security, consider:
  • IP allowlisting for your API servers
  • Rate limiting on your end to prevent accidental overuse
  • Logging all API requests for audit purposes

ā€‹
Checklist

Store credentials in environment variables or secrets manager
Never expose secrets in frontend code
Use HTTPS for all API calls
Implement token refresh before expiration
Verify webhook signatures
Log and monitor API usage
Rotate credentials periodically