Best Practices

This guide lists the practices that keep your app credentials and users’ tokens secure.

USE CASE

Review these security rules before you launch your platform to users.

Details

These are the recommended best practises that you should follow while using the APIs
Never share your app_secret with anyone
Never share your access_token with anyone
Do not provide trading permissions unless you want to use the app to place orders
Provide a redirect_uri which is in your control rather than a public endpoint such as google.com
You should send a random value in the state parameter and verify whether the same value has been returned to you
Do not store the app_secret in the front end. It should be securely kept without exposing it to third parties.
Because appIdHash is built from the app_secret, calculate it and call the token endpoints from your backend, not from front-end code.
Access tokens expire daily at 6:30 AM. Generate a new token after 6:30 AM for it to remain valid throughout the day.
Do not provide trading permissions unless you want to use the app to place orders. See Permission Templates.
If a token is expired or invalid, API calls return error code -8, -15, -16 or -17. See API Error Codes.