Integration checklist

We have made this checklist to help you and ensure that you properly integrate your mobile app with our SDKs.

• Tokens are dynamically generated for my users on my server-side

• Tokens are generated specifically for a CPF (Individual Taxpayer Registration Number) on my server-side

• My tokens are generated using reasonable expiration times

• My server does not generate tokens for unauthorized users on my account

• I'm validating the payload and the SDKs responses signature on my server using my clientSecret

Didn't check all topics? See our tips below to make your app safer!

Always generate the tokens on your server-side

Under no circumstances put your tokens or your clientId and clientSecret directly on your app! A potential attacker could do reverse engineering on your app and get this information and use it to make fraudulent requests on your behalf. This puts your customers at risk and can lead to undue charges on your account.

Always generate tokens as restrictively as possible

Try to limit your keys to specific products you need at that time. Don't use the same clientId and clientSecret with all the products to generate more than one mobile token. Create different access keys with different product activations, and always generate the token using the most appropriate one.

If you already know the user who will make the requests, include his CPF (Individual Taxpayer Registration Number) on the token's payload to limit which data he can access and modify. See how to do this here.

Try to generate tokens with expiration time. This ensures that if a token is leaked, it cannot be used forever.

Validate the responses returned by our SDK

Whenever the user's device is going to perform an operation within your app that grants him more access (device verification or facial authentication), send our SDK's signed response (JWT) to your server side and check if the information's correct (payload data and the signature).

If you validate this response only in your application, a potential attacker could alter your application and remove this validation, giving him the ability to intercept and change your application requests.

The safest way to protect your app from this is to send the signed response (JWT) to your server side and check its integrity before giving the user access.