Security Best Practices

Security Best Practices

Passwords

• Use strong, unique passwords (at least 8 characters with uppercase, lowercase, a number, and a symbol)
• Never reuse passwords from other services
• Use a password manager to generate and store passwords securely

Authentication

• Enable two-factor authentication for all team members
• Consider requiring 2FA at the role level for admin and billing roles
• Store recovery codes in a secure location separate from your password

Access Control

• Follow the principle of least privilege — assign roles with only the permissions each person needs
• Review team access regularly and remove users who no longer need access
• Use separate roles for different job functions rather than giving everyone Full Access

API Tokens

• Store API tokens securely — treat them like passwords
• Set IP allowlists on tokens when the calling server has a known IP
• Set expiration dates on tokens used for temporary integrations
• Use the minimum abilities needed for each integration
• Revoke tokens immediately if they may be compromised
• Monitor token usage (last used IP, request count) for suspicious activity

Webhooks

• Always verify HMAC signatures on incoming webhook requests before processing them
• Use HTTPS endpoints for all webhooks

Monitoring

• Review the audit log periodically for unexpected actions
• Monitor payment activity for unusual transactions
• Check webhook delivery logs for failed deliveries that might indicate integration issues