Security checklist

• Keep API keys on a trusted backend or serverless function.
• Prefer X-API-Key; never put credentials in browser JavaScript or mobile app bundles.
• Use separate keys for development, staging, and production.
• Rotate a key immediately if it may have been exposed.
• Verify webhook signatures against the raw request body before parsing JSON.
• Redact keys, webhook secrets, authorization headers, and message content from logs.
• Return a 2xx webhook response only after the event is durably accepted.

Administrative controls, provider callbacks, internal accounting data, and operational credentials are intentionally outside this public documentation.