> ## Documentation Index
> Fetch the complete documentation index at: https://docs.caspen.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security requirements and best practices for using the API

## HTTPS Requirement

<Warning>
  **HTTPS Only**: All API requests must be made over HTTPS. HTTP requests will be rejected with a `400 Bad Request` error.
</Warning>

The API enforces HTTPS for all communications to ensure:

* **Data encryption** in transit
* **Authentication token protection**
* **Request and response integrity**
* **Protection against man-in-the-middle attacks**

## TLS Requirements

### Supported TLS Versions

| Version | Support Status  |
| ------- | --------------- |
| TLS 1.3 | ✅ Recommended   |
| TLS 1.2 | ✅ Supported     |
| TLS 1.1 | ❌ Not supported |
| TLS 1.0 | ❌ Not supported |

## Authentication Security

### Token Storage

* **Server-side storage**: Store tokens securely on your backend
* **Environment variables**: Use environment variables, not hardcoded values
* **Avoid client-side storage**: Never store tokens in browsers or mobile app storage

```javascript theme={null}
// Good: Server-side environment variable
const apiToken = process.env.API_TOKEN;

// Bad: Hardcoded in client-side code
const apiToken = "sk_live_abcd1234..."; // NEVER DO THIS
```

### Token Transmission

```javascript theme={null}
// Correct: Authorization header
const response = await fetch('https://api.caspen.com/v1/clients', {
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json'
  }
});

// Incorrect: Token in URL or body
const response = await fetch(`https://api.caspen.com/v1/clients?token=${token}`);
```

## IP Allowlisting

For enhanced security, you can configure IP allowlists for your API keys:

1. Log in to your dashboard
2. Navigate to API keys
3. Configure allowed IP addresses
4. Save your configuration

## Vulnerability Reporting

If you discover a security vulnerability:

1. **DO NOT** disclose it publicly
2. Email [security@caspen.com](mailto:security@caspen.com) with details
3. Include steps to reproduce the issue
4. We'll respond within 24 hours

<Tip>
  Enable security notifications in your dashboard to receive alerts about important security updates and maintenance windows.
</Tip>

## Authentication best practices

* **Never expose credentials in client-side code** - Keep tokens in server-side environments.
* **Use environment variables** - Store credentials outside of source control.
* **Rotate credentials regularly** - Regenerate tokens periodically and revoke unused ones.
* **Use HTTPS only** - Always make requests over HTTPS to protect credentials in transit.
* **Implement proper error handling** - Avoid logging tokens or sensitive data.