Integration security

Credentials

Select the minimum scopes for each workload. Keep staging and production keys separate. Store application and platform secrets in backend secret stores and replace/revoke unused credentials.

The full application key is shown once. A key prefix identifies a credential; it cannot be used to reconstruct the secret.

Customer isolation

Notify gets tenant and application identity from the credential. Account-aware operations resolve account_key within that application. An application key can act across its application's accounts; do not treat it as a single-customer credential.

Your backend must authorize the current user's organization membership before sending account-specific requests or issuing user tokens. Frontends receive only recipient-bound tokens.

Browser configuration

Allow the exact frontend origins that call the User API in Notify's CORS configuration. CORS is a browser access policy, not a replacement for authentication or authorization.

Clear tokens, inbox state, and account-specific SSE connections on logout or organization switching.

Provider configuration

Keep provider secrets in encrypted provider configuration, not account metadata. Retain a protected backup of the master encryption key. Changing that key without a migration makes existing ciphertext unreadable.

Logging

Record timestamps, environment, endpoint, HTTP status, request ID, and notification/delivery IDs. Avoid logging Authorization headers, provider secrets, full push subscription payloads, or sensitive message content.