Skip to content
WhatsTIG
Get started

Security best practices

API keys

  • Store keys in a secret manager or server-side environment variables. Never commit them, log them, or send them to browsers or mobile apps.
  • One key per service and environment, with the minimum scopes. Rotate periodically and immediately when a person with access leaves.
  • Revoke unused keys. The dashboard shows when each key was last used.

Webhooks

  • Verify the WhatsTIG-Signature on every request, using the raw body and a 5-minute tolerance.
  • Deduplicate on the event id; reject replays older than your tolerance.
  • Use a dedicated, unguessable path and HTTPS only. Return 2xx quickly and process asynchronously.
  • Rotate the signing secret if it may have leaked (POST /v1/webhooks/{id}/rotate-secret).
  • A QR code or pairing code links a WhatsApp account to WhatsTIG. Show it only to the account owner, over HTTPS, and never store it.
  • Fetch QR codes through your backend (your API key stays server-side) or use hosted connect links.
  • Treat connect links as secrets: short TTL, send only to the intended person, do not put them in logs or analytics.

Personal data

  • Store only what you need: disable "Retain message content" for projects that only send notifications.
  • Respect opt-outs and keep proof of consent in your own system.
  • Delete instances, media and organizations you no longer use; WhatsTIG deletes data after the plan's retention.

Dashboard accounts

  • Enable two-factor authentication, especially for owners and admins.
  • Give teammates the lowest role that works (viewer, developer).
  • Review the audit log (Organization → Audit log) for unexpected key creation, webhook changes or logouts.

What WhatsTIG does for you

  • Session credentials and webhook secrets are encrypted (AES-256-GCM) with keys held outside the database, and bound to their row so they cannot be swapped between instances.
  • API keys are stored as keyed hashes; secrets are shown once.
  • Every query is scoped to the caller's project; foreign resources return 404.
  • Webhook and media-import requests are protected against SSRF (private addresses blocked after DNS resolution, no redirects, size and time limits).
  • Uploads are size-limited while streaming and their content is checked against the declared type.
  • Logs redact credentials, tokens, QR payloads and message text.
  • Rate limits protect against abuse; all administrative actions are audit-logged.

Report vulnerabilities to security@whatstig.com.