Connection verification
Each service, partner, provider and environment uses separate keys and a separate account.
Documentation / API Security
API Authentication and Security
Set up secure API access: choose an authentication method, protect requests with signatures, separate permissions, restrict network access and establish activity monitoring.
Access
connection verification
Signature
request protection
Roles
permission separation
Monitoring
activity history
Security model
Protection at every API layer
01
Connection verification
A separate API key, OAuth 2.0 client, JWT or service account for each connected service.
02
Request verification
Signature, request time, unique identifier and protection against replay.
03
Authorization check
Roles, permissions, IP addresses, environment and permitted operation limits.
04
History and monitoring
Request identifier, initiator, result, alerts and incident response procedure.
Overview
API security uses several layers of protection
An API key alone is not enough. A reliable model verifies the connected service, request integrity, permission to perform the operation, the allowed network source and retains an activity history.
Request integrity
The signature, request time and unique identifier protect the request from modification and replay.
Activity history
The log links the request, initiator, performed operation, result and subsequent changes.
Authentication
How to choose an authentication method
The choice depends on the integration type, number of connections, access lifetime and the need to delegate specific permissions.
API keys
Suitable for direct system-to-system exchange when each client and environment has its own key.
OAuth 2.0
Suitable for managed access with limited permissions, short lifetimes and centralized revocation.
JWT
Carries information about the subject, audience, expiry and permissions, with mandatory signature verification.
Service accounts
Allow automated processes, system permissions and responsibility for individual integrations to be separated.
Do not use one set of credentials for multiple systems
Separate keys and accounts allow one integration to be restricted or disabled without stopping other modules.
Request signing
Request signing and replay protection
A signature confirms the request source and helps verify that the data has not been changed after sending.
01
Build the request data
In the agreed order, combine the HTTP method, path, parameters, request time, unique identifier and body checksum.
02
Create the signature
Calculate an HMAC or digital signature using the assigned secret or private key.
03
Check time and uniqueness
Reject an expired request, a repeated identifier or an operation that has already been processed.
04
Verify the signature securely
Rebuild the request data on the receiving side and compare the calculated signature with the received signature.
Access and roles
Network access, roles and key lifetime
After the connection is verified, the API determines the request source, permitted operation and validity of access in the selected environment.
Allowed IP addresses
A list of permitted addresses and subnets for the API, incoming events and administrative access.
Roles
Separation of operator, financial, administrative and system permissions.
Permissions
The minimum set of rights for reading, changing data, payouts, reports or player management.
Environment separation
Test and production environments use different endpoints, keys, incoming events and datasets.
Expiry
Temporary access and short-lived tokens reduce the risk of obsolete credentials being used.
Scheduled key rotation
The old and new keys may both remain valid for a short transition period.
Rate limiting
Request frequency is limited by client, operation, role and risk level.
Rapid revocation
A key, token, role or IP address can be disabled without changing the other integrations.
Data protection
Protecting personal, gaming and financial data
The API transfers only the information required, while storage and display rules reflect the sensitivity of the data.
Storage and processing
Encrypt sensitive data and secrets at rest.
Mask tokens, payment details and personal data in interfaces.
Limit retention periods and securely delete operational data.
Separate production and test data without copying unnecessary information.
Transfer and minimization
TLS for all API connections, incoming events and administrative access.
Transfer only the fields required for the specific operation.
Do not place secrets, tokens or sensitive data in page URLs or standard logs.
Filter data in exports, diagnostics and support requests.
Monitoring and audit
Secure operations, audit and incident response
After launch, security is maintained through event monitoring, regular permission reviews, anomaly detection and a clear incident response procedure.
Activity log
Initiator, request identifier, operation, time, result, status change and reason for the decision.
Status monitoring
Login errors, invalid signatures, rising failure rates, delays and unusual activity from a connected service.
Security alerts
Alerts for repeated requests, sudden activity spikes, disallowed IP addresses and critical actions.
Incident response
Restrict access, revoke keys, preserve history, recover services and notify responsible teams.
Security testing
Expired tokens, invalid signatures, unauthorised permissions, replayed requests and attempts to bypass restrictions.
Access review
Regularly review active keys, accounts, roles, IP addresses and unused permissions.
Pre-production security review
Production access is issued after authentication methods, request signing, permissions, logging and the incident response plan have been verified.
Separate access keys have been created for test and production environments.
Signature verification, request time and replay protection have been tested.
Roles and permissions are limited to the operations that are actually required.
Allowed IP addresses, TLS and incoming event endpoints have been confirmed.
Secrets do not appear in page URLs, standard logs or client-side code.
Logging, alerts, key rotation and access revocation procedures are configured.
Need to configure secure API access?
Provide details of the connected systems, users, environments, critical operations and data requirements. APIACE will help define an appropriate access and protection model.