API security

How keys are protected

• Keys are long random secrets. WonderFatoora stores only a fingerprint and shows the key once.
• Keys expire (30 to 365 days) and can be rotated or revoked at any time.
• Keys are accepted in headers only, never in URLs.
• Repeated failed attempts from one address are refused for a while.
• A key is limited by its scopes and by the current permissions of the person who created it.
• Creating, rotating and revoking keys is recorded in the company's audit log.

Isolation between companies

The company is fixed by the key. Ids from other companies behave exactly like ids that do not exist, so the API never confirms that another company's record exists.

Data in responses

• HTTPS only.
• Responses contain only the documented fields.
• Errors carry no internal details; an unexpected failure returns a generic server_error.

What we ask of you

• Keep keys on your servers, in environment variables or a secrets manager; never in browsers, mobile apps, logs or repositories.
• Use one key per system, with only the scopes it needs, and a separate key for issuing where you can.
• Rotate keys on a schedule, and at once if one may have leaked; revoke keys you no longer use.
• Send external_reference when issuing, so retries cannot create duplicates.
• Treat public_url like a share link: anyone who has it can open that invoice.

Reporting a vulnerability

Write to us through the contact link at the end of this page, with details and steps to reproduce. Please do not access other companies' data or degrade the service while testing.