Alan avatar image
Alan asked Alan commented

Best practices with Merchant's Auth Tokens

Hi DevAsk,

I'm developing an application that will rely on interaction between our external server. I'm wondering are there any restrictions on using the merchant's Auth token's outside of the clover application on a secured server, to create an order or query their inventory for example.

Is there any issues with taking the auth token across a 2048SSL connection, or anything that would prevent approval of our application?

Thank you

10 |2000

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

1 Answer

Brian Murray avatar image
Brian Murray Deactivated answered Alan commented

We don't have any specific restrictions on how apps can use auth tokens. We ask that developers understand that auth tokens are sensitive and take reasonable precautions to protect them.

The key point is that actions taken with an auth token are viewed as actions taken by the associated app. If the auth token is leaked, any malicious activity will be logged as coming from the associate app. When the malicious activity is detected, we will disable the auth token, and, in doing so, disable the associated app. We will also disable the auth tokens for each merchant using the app unless we can quickly confirm that only a subset of auth tokens were compromised.

Some best practices:

  • Do not share auth tokens with 3rd parties. For example, do not embed auth tokens in public facing web page and use client side javascript to make calls to Clover's servers.
  • Request authtokens with the minimal permissions necessary for your app. When possible, request read only permissions instead of full permissions.
  • Avoid storing auth tokens in logs. Configure the logging framework to mask auth tokens in URLs.
1 comment
10 |2000

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Alan avatar image Alan commented ·

Thanks Brian, thats exactly what I wanted to hear too!

0 Likes 0 ·

Welcome to the
Clover Developer Community