Security best practices

Keep the private key in a secrets manager or HSM

Load it at runtime from AWS Secrets Manager, Azure Key Vault, HashiCorp Vault or an HSM. Never commit it, email it, paste it into a ticket, or send it to Ryno.

Use one credential per environment

Sandbox and production have separate certificates and client IDs. Never reuse a production key in sandbox.

Sign a fresh assertion every time

Use a new jti and a 60-second expiry. Never cache, log or reuse an assertion.

Cache tokens in memory only

Keep access tokens in process memory until shortly before they expire. Do not write them to disk, databases or logs.

Request the least scope

Only processes that write should request partner.write.

Keep clocks in sync

Run NTP on every server that signs assertions. Clock drift causes rejected assertions.

Verify every webhook

Check Ryno-Signature in constant time and reject deliveries older than five minutes. See Verifying deliveries.

Plan certificate rotation

Track the certificate's expiry date and request rotation well before it. If a key may be compromised, contact support immediately so Ryno can suspend the credential.