> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fidel80.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Best Practices

> Protect Fidel80 API credentials and build safer integrations.

Use these practices when integrating with Fidel80.

## Keep API keys server-side

Fidel80 API keys are credentials and should be treated like passwords.

* Never expose an API key in browser or frontend code.
* Do not commit API keys to source control.
* Store keys in environment variables or a secrets manager.
* Limit access to keys to the systems that need them.

## Protect the full API key

The complete API key is shown when it is created.

Store it securely because Fidel80 stores a hashed representation rather than the original value.

If you believe a key has been exposed, revoke it and create a new one.

## Use separate keys where appropriate

Use separate API keys for separate applications, services, or environments where practical.

This makes it easier to:

* identify which integration is using a key,
* revoke one integration without affecting another,
* rotate credentials safely.

## Use HTTPS

Send Fidel80 API requests and receive webhooks over HTTPS in deployed environments.

Do not expose production credentials over unencrypted connections.

## Validate workflow access

Before generating a verification token, confirm that:

* the workflow belongs to the authenticated organization,
* the workflow is active,
* the workflow version belongs to the selected workflow.

Fidel80 also performs these checks when processing the request.

## Protect applicant information

Verification requests may contain applicant information such as names, email addresses, phone numbers, and verification results.

Only collect and store information required for the integration, and restrict access appropriately.

## Handle verification links carefully

Verification links contain a token that grants access to a verification flow.

* Send links only to the intended applicant.
* Avoid exposing tokens in logs where possible.
* Generate a fresh token when a previous token is expired, cancelled, completed, or no longer suitable.

## Webhook security

Only configure webhook endpoints that you control.

The endpoint should:

* use HTTPS,
* accept JSON `POST` requests,
* validate incoming data before processing it,
* return an appropriate success response after processing,
* configure a signing secret where webhook authenticity must be verified,
* verify the `X-Fidel80-Signature` before trusting a signed webhook.

For signed webhooks, Fidel80 sends:

```http theme={null}
X-Fidel80-Timestamp: <unix-timestamp>
X-Fidel80-Signature: sha256=<hex-digest>
```

The signature is an HMAC-SHA256 digest calculated over:

```text theme={null}
{timestamp}.{raw-request-body}
```

Use the webhook signing secret as the HMAC key and compare signatures using a constant-time comparison.

> [!WARNING]
>
> Verify the exact raw request body. Parsing and re-serializing the JSON before verification can change the signed bytes and cause signature validation to fail.

## Rate limits

No public API rate-limit policy is documented here because a rate-limit implementation has not yet been verified in the current Fidel80 codebase.

Do not assume a specific request limit unless one is provided for your Fidel80 environment.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.