Security

Your private key stays yours

Anis never sees your private key — only its public half, at enrolment. Keep the private half where you keep your most sensitive secrets: a key vault, a hardware security module, or a file only your service can read.

• Never put it in a settings file, an environment variable, source control or anywhere a log or crash report can reach.
• Signing only needs something that can sign bytes with ECDSA P-256 and return the 64-byte signature. A vault or hardware module that signs on your behalf can do it without the key ever entering your application — the SDKs accept any such signer.

Every answer is verified

Anis signs every answer, and your client checks it before acting on it — see Verifying answers. An answer that fails the check is thrown away: never act on it, never log it and carry on. Enrolment answers are signed too.

One address per deployment

Each Anis deployment is fully separate — its own address, keys and data. There is no setting that switches between them; the address you call decides. A key enrolled with one deployment means nothing to another.

Replacing and revoking your key

• Replacing: Anis staff start the replacement and send you a new invitation; enrol the new key. Both keys work during the overlap Anis sets — move to the new key id within it.
• Revoking: from the moment a key is revoked, every call signed with it is refused as invalid_credentials. To sign again, enrol a new key from a new invitation.
• If you think your key leaked, tell Anis at once so staff can revoke it.

Allowed networks

Your application may only be called from the networks agreed with Anis. A call from anywhere else is refused as insufficient_scope — the same answer as a missing permission, on purpose.

Card codes are secrets

Card codes appear in exactly two places: the answer that first reports a completed order, and a reveal. Store them where you keep secrets, and never write them to logs, traces or error reports.

Clock

Signatures carry their time, and so do Anis’s answers. Keep your server clock synchronised (NTP): a clock that drifts gets requests refused as invalid_credentials and answers discarded as too old. Sign for 60 seconds or less — see Signing requests.