# 1. API Access & Authentication Keys
Use the authentication method documented for each API and the access enabled for your plan. Protect API keys and tokens, restrict their permissions, and rotate them if exposed. Do not use another workspace’s credentials or bypass authorization.
# 2. Rate Limits & Fair Usage
Authenticated APIs may have plan-based rate and usage limits. Follow current documentation and HTTP 429 responses rather than assuming a universal requests-per-minute allowance. Public credential verification is separate from paid API quotas. Security protections may restrict abusive traffic.
# 3. Webhook Security & Signatures
Outbound webhooks use the Certifada-Signature header with timestamp and HMAC SHA-256 values. Verify the signature against the raw request body and configured secret, check timestamp freshness, and handle retries safely. Follow the developer documentation for the exact signed payload format.
# 4. API Deprecation & Version Policy
We aim to give reasonable notice of breaking API changes and provide migration guidance. Urgent security or legal changes may require faster action. A specific notice period in an existing binding agreement remains applicable; this overview does not create a new blanket version-support guarantee.