Best Practices

This guide lists the practices that keep your app credentials and tokens secure.

USE CASE

Check your app against these security rules before you start using it regularly.

Details

These are the recommended best practises that you should follow while using the APIs
Never share your app_secret with anyone
Never share your access_token with anyone
Do not provide trading permissions unless you want to use the app to place orders
Provide a redirect_uri which is in your control rather than a public endpoint such as google.com
You should send a random value in the state parameter and verify whether the same value has been returned to you
Access tokens expire daily at 6:30 AM. Generate a new token after 6:30 AM for it to remain valid throughout the day.
Do not provide trading permissions unless you want to use the app to place orders. See Permission Templates.
If a token is expired or invalid, API calls return error code -8, -15, -16 or -17. See API Error Codes.