Security for developers

Security for developers

Key storage

• Store API keys and webhook secrets as environment variables on your server (INVOICLY_API_KEY, INVOICLY_WEBHOOK_SECRET).
• Never put keys in client-side JavaScript, mobile apps, URLs, logs, or git. If a key is committed, revoke it and rotate — don't just delete the commit.
• In Next.js, use server-only code or server-only imports for anything that touches keys; never prefix them with NEXT_PUBLIC_.

Key rotation

Rotate on a schedule (quarterly is a good default) and immediately if a key leaks:

1. Create the new key in Settings → API keys.
2. Deploy it to your server.
3. Verify live traffic uses the new key.
4. Revoke the old key. Revocation is immediate and final.

Webhook verification

• Verify the Biz Invoice Pay-Signature header on every delivery (see the Node and PHP code).
• Compare against the raw request body, use constant-time comparison, and reject signatures older than 5 minutes (replay protection).
• Respond 2xx quickly (within 10 seconds) and do heavy work asynchronously — slow endpoints burn your retry budget.

HTTPS everywhere

• Live checkout redirects (success_url, cancel_url) must be absolute HTTPS URLs.
• Webhook endpoints must be HTTPS; HTTP endpoints are rejected in live mode.
• In dev, http://localhost is fine.

Least privilege

• Use one key per integration ("Website checkout", "WooCommerce", "Reporting script") so revoking one doesn't break the others.
• Keys act as your business with owner-level API access — there are no per-key scopes yet, so guard them like passwords.
• Human team members get roles, not keys: staff and managers use their own logins with limited permissions (see Team and roles). Never share the owner's login.