Skip to main content

Integration security

Secrets​

  • Keep tenant API and webhook keys in a managed secret store.
  • Issue one least-privilege key per service/environment.
  • Never place tenant keys in Web/mobile clients.
  • Rotate through overlap and revoke the predecessor.
  • Redact prefixes and credentials from logs, support tools and screenshots.

Applicant credentials​

The invitation URL grants scoped access to one application. Exclude it from analytics, referrer propagation, link previews, proxy access logs and crash reporting. Revoke/rotate immediately after suspected disclosure.

Evidence​

Collect only what the workflow requires. Avoid duplicating document, biometric or NFC bytes into your own platform unless there is a defined legal and security requirement. Use application IDs and signed receipts for ordinary reconciliation.

Browser and embed controls​

  • exact HTTPS origins;
  • restrictive CSP and frame-src;
  • camera permission policy only for the Assayra origin;
  • no wildcard postMessage target;
  • bridge source, origin and protocol-version validation; and
  • secure completion URLs without invitation tokens.

Webhooks​

Verify raw-body HMAC and timestamp before JSON parsing, deduplicate deliveries and process asynchronously. Never allow source IP alone to replace signature verification.

Reporting​

Do not send sensitive evidence by email. Use the tenant support/security channel with application/evidence IDs and safe timestamps. Preserve relevant audit/receipt data and rotate exposed credentials before continuing diagnosis.