Security

Your secret key

• Backend only. It authorises everything you can do; a browser must never see it. Keep it in your environment or secret manager.
• We store a SHA-256 hash, not the key. We cannot recover it or show it to you again — if it is lost, rotate it.
• Rotation has a grace window. The old key keeps working for a short period so you can deploy without downtime, then dies.
• Revocation is immediate. A revoked key stops working on the next request, everywhere.
• Self-identifying prefix. Keys start with ak_live_/ak_test_ so secret scanners can flag one that leaks into a repository.

Least privilege by scope

provision and broadcasts are independent. Ask for one key per capability and the blast radius of a leak shrinks accordingly: an integration key that leaks cannot message a single end customer.

Workspace isolation

This is the part worth scrutinising, because it is what keeps your clients apart from each other and your data apart from other partners’.

• You never send a workspace id. There is no such field. We derive it from (your partner identity, your external_client_ref) — an attacker cannot widen a request by editing a body.
• Every query runs under row-level security bound to that one workspace. Cross-workspace reads are not filtered out after the fact; they are impossible at the database level.
• References are namespaced per partner. The same external_client_ref used by two partners resolves to two different workspaces. Someone else’s reference returns 404.
• A tenant-bound key cannot use partner-level scopes. A key restricted to one client is rejected outright on endpoints that resolve the client from a reference.

Attack surface

The API has no browser surface: no CORS layer, no cookies, no session tokens. Every caller is a server holding a secret. There is nothing to embed and nothing to steal from a page.

Audit trail

Provisioning, WhatsApp signups, administrator changes and campaigns each leave an append-only record with the key that performed it and the originating IP. Ask us for an export any time; it is also visible per-partner in the Auphere panel.

What we store about your clients’ customers

• Phone numbers, conversations and message status — the operational minimum to run messaging.
• Opt-outs, honoured automatically on every subsequent send.
• Credentials you send us for connectors are encrypted at rest and never returned by any endpoint.