Security

Baseline security practices for Seller API integrations: credentials, rotation, allowlisting, and webhook posture.

• Seller API keys are server-to-server only. Never embed them in browsers, mobile apps, public repos, or client-side SDKs.
• Store the raw token in your secret manager. Avrix shows it once at creation and stores only a hash.
• Use least-privilege scopes. A key with no scopes is rejected on every request.
• Prefer sandbox keys (avrix_sk_sbx_your_key_here style) until certification; never point production keys at sandbox hosts or the reverse (KEY_ENVIRONMENT_MISMATCH).

1. Create a second key with the same scopes and environment.
2. Copy IP allowlist entries onto the new key before cutover.
3. Deploy the new key to your pre-production stack first, then production.
4. Verify with GET /whoami, a catalog read, and a dry-run preview.
5. Revoke the old key.

Both keys are valid until the old one is revoked. After revoke, expect a short propagation window before all edges deny the old token.

1. Revoke the exposed key immediately.
2. Create a replacement with minimum scopes and a tight allowlist.
3. Review recent X-Request-Id values, webhook URL changes, and pull volume.
4. Pause suspicious webhook endpoints if exfiltration is possible.
5. Escalate through your support channel with key id, last safe deploy time, and request ids.

allowed_ips on a key is optional when empty (any source IP). When entries are configured, mismatches return 403 IP_NOT_ALLOWED.

When you register a webhook URL, Avrix enforces delivery-time safety checks so your endpoint cannot be abused as an open proxy into private networks:

• HTTPS only for registered URLs
• Destination resolution and rejection of private / reserved / loopback targets
• Unsafe redirect blocking
• Response size caps, timeouts, and automatic disable of persistently failing endpoints

Your responsibilities:

• Verify X-Avrix-Signature (HMAC over raw body) before side effects
• Keep the webhook secret in a secret manager; rotate with overlap
• Return 2xx quickly; process asynchronously
• Never trust webhook bodies for key plaintext (there is none)

• Do not log mutation responses that may contain game keys.
• Do not put end-customer email, name, or address into integrationOrderContext or free-form metadata when an opaque reference will do.
• Redact PSP secrets and webhook secrets from support tickets; use requestId and orderReference instead.

• Authentication
• Webhooks
• Data handling
• IP allowlist