---
title: "Security best practices"
description: "Credential, transport, and webhook security recommendations for API integrations."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.wazapin.id/llms.txt
> Use this file to discover all available pages before exploring further.

# Security best practices

Use this checklist before going live.

## Credential handling

- Store bearer tokens and API keys in server-side secret manager.
- Never expose credentials in browser-side JavaScript.
- Rotate credentials on schedule and immediately after suspected leaks.
- Use separate credentials for staging and production.

## Transport security

- Use HTTPS for all requests.
- Enforce modern TLS at your edge.
- Avoid logging full authorization headers.

## Request integrity

- Validate all IDs and enums before sending requests.
- Implement idempotency strategy in your integration layer for retries.
- Add bounded exponential backoff for `429` and `5xx` responses.

## Webhook security

- Verify webhook signatures on every delivery.
- Reject stale or malformed webhook payloads.
- Deduplicate events by stable IDs.
- Return fast acknowledgement and process asynchronously.

## Access control

- Prefer least-privilege API keys.
- Segment access by organization/workspace boundaries.
- Audit credential usage and remove unused keys.

:::warning
Do not hardcode API keys in mobile apps, frontend bundles, or public repositories.
:::

## Related pages

- [Permissions matrix](/api/permissions-matrix)
- [Message lifecycle and idempotency](/api/message-lifecycle-idempotency)

Source: https://docs.wazapin.id/api/security-best-practices/index.mdx