Skip to main content

Security

Credential rules​

  • Store API keys, access tokens, and refresh tokens in an approved server-side secret manager or protected environment configuration.
  • Never commit credentials to source control.
  • Never include credentials in URLs.
  • Never expose secrets in frontend bundles, browser clients, or mobile clients.
  • Redact credentials, Authorization headers, and passwords from logs, analytics, screenshots, and error reports.
  • Keep Sandbox and Production credentials separate.
  • Restrict secret access to the smallest required scope.

Exposure response​

If an API key is exposed, deactivate it through the Mailhub application and remove it from every unsafe location. Revoke a refresh session when ending a session or rotating client state. Follow Get an API Key and Authentication for the verified credential flow.

Do not assume automatic rotation, named keys, key scopes, expiration policies, or one-time-only reveal behavior.

Transport and storage​

Use HTTPS for all API requests and protect locally stored shipment and customer data according to your security and privacy requirements.