Security

Store the API key server-side only

Sign requests with an HMAC signature

HTTPS required

Use an IP allowlist

Rotate API keys regularly

Always verify callback signatures