Integration security checklist
Protect credentials, content, tenant scope, custom fields, webhooks, logs, and client bundles.
Trusted server
- Store application credentials and webhook secrets in a protected secret manager; rotate and revoke them deliberately.
- Authenticate your product user before deriving a V Chat user ID or issuing a token.
- Use exact tenant/app/environment configuration and never accept client-provided scope as authority.
- Verify webhook signatures over raw bytes before parsing and deduplicate delivery IDs.
- Do not log tokens, cookies, message content, arbitrary bodies, private URLs, or customer custom data.
Browser and Flutter
- Use only short-lived app-user tokens and keep them in memory.
- Never bundle application credentials, dashboard cookies, webhook secrets, or signing keys.
- Treat cached data as presentation state, not authorization proof.
- Cancel obsolete requests, dispose sessions on account switch, and isolate offline stores by exact app-user scope.
- Show stable error codes and safe recovery actions instead of raw server messages.
Content and custom fields
Custom JSON, filters, files, arrays, and text are explicitly allowlisted and bounded by the API. Escape untrusted content in your UI, avoid putting secrets in custom fields, and do not treat client-side sanitization as a substitute for server validation.