# 1. API Access & Authentication Keys
API access requires active API keys or OAuth2 bearer tokens. Developers are responsible for maintaining secret key confidentiality and preventing token leakages.
# 2. Rate Limits & Fair Usage
API endpoints are subject to rate limiting (e.g. 600 requests/minute per workspace). Requests exceeding rate limits will receive HTTP 429 Too Many Requests responses.
# 3. Webhook Security & Signatures
Webhook events include HMAC SHA-256 signatures in the X-Certifada-Signature header. Receiving servers must verify signatures prior to processing payloads.
# 4. API Deprecation & Version Policy
Certifada provides a minimum of 12 months advance notice prior to deprecating any major API version, ensuring smooth transitions for enterprise integrations.