Security
How keys are stored, how to pin them to addresses, and how fast a revocation takes effect.
How keys are stored, how to pin them to addresses, and how fast a revocation takes effect.
API keys
Shown once, stored as a hash. What that means for you, and how to handle a key you cannot read back.
IP allowlist
Pin a key to addresses or CIDR ranges. A refusal returns a different code from a bad key, on purpose.
Revocation timing
Nothing is cached in the credential. Revoking a key takes effect on the very next call.
Developer console sign-in
Password, email code or passkey; a mandatory second step for new accounts; devices, activity and account recovery.
Rotate the webhook signing secret POST
Issues a new signing secret and invalidates the old one immediately — there is no overlap window. Deploy the new secret to your receiver promptly; the retry policy (3 attempts with exponential backoff) covers a rollout measured in seconds, not hours. Signature scheme (unchanged): every delivery carries `X-WASync-Signature: sha256=<hex>` = HMAC-SHA256 of `${X-WASync-Timestamp}.${rawBody}` keyed with this secret. `X-WASync-Timestamp` is epoch milliseconds; reject anything older than 5 minutes. Verify over the RAW body, before parsing. Full contract: https://developers.wasync.app/docs/webhooks
API keys
Shown once, stored as a hash. What that means for you, and how to handle a key you cannot read back.