Security

​

Authentication

• Servers use an API key: X-Api-Key and X-Api-Secret on every request, from a whitelisted IP.
• People sign in to the dashboard with an email code or a passkey. Dashboard sign-in only works in the dashboard.

​

API key hygiene

• One key per system and environment — use separate API keys so you can rotate or revoke one without affecting the others.
• Never expose keys client-side — API credentials belong on your server. Do not embed them in mobile apps, browser JavaScript, or public repositories.
• Revoke after suspected exposure — revoke the key in Developers → API Keys straight away, then create a new one.
• Whitelist the fewest IPs you can — single addresses rather than ranges. See IP whitelisting.
• Store in secrets managers — use environment variables or a dedicated secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.), not plaintext config files.

​

Webhook signature verification

const crypto = require('crypto');

function verifySignature(rawBody, signature, secret) {
  const hmac = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(hmac),
    Buffer.from(signature)
  );
}

​

HTTPS only

​

IP whitelisting

​

Idempotency

curl -X POST 'https://api.yativo.com/api/v1/sendmoney' \
  -H 'X-Api-Key: YOUR_API_KEY' \
  -H 'X-Api-Secret: YOUR_API_SECRET' \
  -H 'Idempotency-Key: your-unique-request-id-abc123' \
  -H 'Content-Type: application/json' \
  -d '{ ... }'

​

Rate limits

​

Sensitive data handling

• Virtual card sensitive details (full PAN, CVV) are returned only on the card detail endpoint and should be displayed in-app temporarily — never logged or stored on your servers.
• Yativo is PCI-DSS compliant. Do not log or store raw card data in your systems.
• Customer PII (names, emails, phone numbers) should be treated as sensitive. Limit access in your systems to only those who need it.

​

Error responses

{
  "status": "failed",
  "status_code": 401,
  "message": "Request failed.",
  "data": {
    "error": "Invalid or revoked API credentials."
  }
}