Security

Security is a foundational requirement, not an afterthought. This page covers how Wajub protects your integration and what you need to do on your side.

API key security

The three-key model

Wajub uses three key types, each with a distinct security boundary:

Browser protection

Wajub automatically detects private keys used from browsers by checking Origin and Referer headers. Requests using a private key from a browser are rejected with 403 and the team owner is alerted.

Key rotation

Rotate your keys periodically and whenever a team member leaves. Rotation is instant from Dashboard → Developers → API Keys and does not affect your other keys.

What to do if a key leaks

1. Revoke the compromised key immediately in the Dashboard.
2. Rotate it and update all services using it.
3. Review your API logs in Konsole for suspicious activity.

Webhook signature verification

Every webhook sent by Wajub is signed with a hash of the payload and your webhook signing secret. Always verify the signature before processing the event.

import { Wajub } from '@wajub/node';

// express.raw() keeps req.body as a Buffer — required for HMAC verification.
// The MIME wildcard '*/*' ensures this middleware runs for all content-types.
app.post('/webhooks', express.raw({ type: '*/*' }), async (req, res) => {
const event = wajub.webhooks.constructEvent(
  req.body,
  req.headers['x-wajub-signature'],
  req.headers['x-wajub-timestamp'],
  process.env.WAJUB_WEBHOOK_SECRET,
);
// Acknowledge before processing (prevents retries on slow handlers)
res.sendStatus(200);
// Process the verified event
});

See Webhook signature verification for examples in other languages and manual verification.

Transport security

• All API traffic must use HTTPS. HTTP requests are redirected.
• API base URL: https://api.wajub.com
• Webhook endpoints must also be HTTPS.
• TLS version: 1.2 minimum.

Data isolation

Sandbox vs Live

Test and production environments are completely isolated. A sandbox key cannot access live data and vice versa. Sandbox data can be reset; live data cannot.

Per-team isolation

Each team's data is fully isolated. No cross-team data access is possible, even with API keys from different teams.

Best practices checklist

• Store keys in environment variables, never in source code.
• Never prefix keys with NEXT_PUBLIC_ or equivalent.
• Use restricted keys for third-party integrations.
• Verify all webhook signatures.
• Rotate keys periodically and after team changes.
• Enforce 2FA for your team in the Dashboard.
• Assign team roles with least privilege.
• Keep your server dependencies updated.

Reporting a vulnerability

If you discover a security vulnerability, please report it directly to security@wajub.com. Do not open a public issue. We respond within 24 hours.