Secure API Integration Playbook

Strict validation, payload sanitization, and disciplined JWT handling keep API integrations safer and maintainable.

Checklist

1. Validate everything — schema-parse inputs; never trust client shape.
2. Sanitize outputs — strip internal fields before responding.
3. JWT discipline — short TTL, refresh rotation, server-only verification.
4. Rate limit — token bucket per identity, not per IP only.
5. Idempotency — dedupe webhooks by signature + key.
6. HMAC webhooks — verify x-signature with constant-time compare.