Documentation menu
Docs / Launch
Security for integrators
How to keep credentials, customers and your integration safe.
Credentials#
| Credential | Where it may live |
|---|---|
| Client secret | Your servers only, in a secrets manager |
| Webhook signing secrets | Your servers only |
| SDK key | Your web or mobile app; it identifies you, but grants no access to the API |
| Access tokens | Your servers only; cache them for up to 900 seconds |
| Session and result tokens | Your app may hold them; they are single use and short lived |
Rotate the client secret in the portal if it may have been exposed: the old secret and every token issued with it stop working at once. Rotate webhook secrets with two active secrets, as described in Webhooks.
Your server#
- Call the Tenant API only from your servers, over TLS 1.2 or later.
- Verify every webhook signature against the raw body, and reject timestamps more than five minutes old.
- Use an Idempotency-Key on every request that creates or changes a record.
- Log
A2A-Request-Idvalues, never secrets or full personal data.
Your web app#
- Open hosted screens only from a tap or click, never in an iframe or WebView.
- Allow only the A2A InstaPay and Plaid domains your integration uses in your content security policy.
- Register exactly the origins and return pages you use.
Customer data#
- The customer's PIN, passkey, SSN and bank credentials are entered only on A2A InstaPay's screens and Plaid's; your app never sees them.
- Keep only the personal data you need, and protect it as your partnership documents require.
In the sandbox#
- Never enter real personal information. Use the test data.
- Sandbox credentials start with
cli_sbx_,sk_sbx_,pk_sbx_andwhsec_. They never work in production. - The sandbox refuses webhook addresses on private networks.
Reporting a vulnerability#
If you find a security issue in A2A InstaPay or the sandbox, report it through the support form with the topic "Report a security issue". Please give us reasonable time to fix it before you share it, and do not access other Tenants' data, degrade the service or use social engineering while you investigate.
Questions about this page? Contact developer support.