Skip to main content

​
HTTPS Requirement

HTTPS Only: All API requests must be made over HTTPS. HTTP requests will be rejected with a 400 Bad Request error.
The API enforces HTTPS for all communications to ensure:
  • Data encryption in transit
  • Authentication token protection
  • Request and response integrity
  • Protection against man-in-the-middle attacks

​
TLS Requirements

​
Supported TLS Versions

VersionSupport Status
TLS 1.3✅ Recommended
TLS 1.2✅ Supported
TLS 1.1❌ Not supported
TLS 1.0❌ Not supported

​
Authentication Security

​
Token Storage

  • Server-side storage: Store tokens securely on your backend
  • Environment variables: Use environment variables, not hardcoded values
  • Avoid client-side storage: Never store tokens in browsers or mobile app storage
// Good: Server-side environment variable
const apiToken = process.env.API_TOKEN;

// Bad: Hardcoded in client-side code
const apiToken = "sk_live_abcd1234..."; // NEVER DO THIS

​
Token Transmission

// Correct: Authorization header
const response = await fetch('https://api.caspen.com/v1/clients', {
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json'
  }
});

// Incorrect: Token in URL or body
const response = await fetch(`https://api.caspen.com/v1/clients?token=${token}`);

​
IP Allowlisting

For enhanced security, you can configure IP allowlists for your API keys:
  1. Log in to your dashboard
  2. Navigate to API keys
  3. Configure allowed IP addresses
  4. Save your configuration

​
Vulnerability Reporting

If you discover a security vulnerability:
  1. DO NOT disclose it publicly
  2. Email [email protected] with details
  3. Include steps to reproduce the issue
  4. We’ll respond within 24 hours
Enable security notifications in your dashboard to receive alerts about important security updates and maintenance windows.

​
Authentication best practices

  • Never expose credentials in client-side code - Keep tokens in server-side environments.
  • Use environment variables - Store credentials outside of source control.
  • Rotate credentials regularly - Regenerate tokens periodically and revoke unused ones.
  • Use HTTPS only - Always make requests over HTTPS to protect credentials in transit.
  • Implement proper error handling - Avoid logging tokens or sensitive data.