---
title: "Security — Anis Developers"
description: "Keeping your key safe, why every answer is verified, key replacement and revocation, card codes and your clock."
url: https://developers.anis.ly/docs/security/
language: en
---

> Every page of this documentation: https://developers.anis.ly/llms.txt

# Security

## Your private key stays yours

Anis never sees your private key — only its public half, at enrolment. Keep the private half where you keep your most sensitive secrets: a key vault, a hardware security module, or a file only your service can read.

- **Never** put it in a settings file, an environment variable, source control or anywhere a log or crash report can reach.
- Signing only needs something that can sign bytes with ECDSA P-256 and return the 64-byte signature. A vault or hardware module that signs on your behalf can do it without the key ever entering your application — the SDKs accept any such signer.

## Every answer is verified

Anis signs every answer, and your client checks it before acting on it — see [Verifying answers](https://developers.anis.ly/docs/verifying-answers.md). An answer that fails the check is thrown away: never act on it, never log it and carry on. Enrolment answers are signed too.

## One address per deployment

Each Anis deployment is fully separate — its own address, keys and data. There is no setting that switches between them; the address you call decides. A key enrolled with one deployment means nothing to another.

## Replacing and revoking your key

- **Replacing:** Anis staff start the replacement and send you a new invitation; enrol the new key. Both keys work during the overlap Anis sets — move to the new key id within it.
- **Revoking:** from the moment a key is revoked, every call signed with it is refused as [`invalid_credentials`](https://developers.anis.ly/errors/invalid-credentials.md). To sign again, enrol a new key from a new invitation.
- **If you think your key leaked,** tell Anis at once so staff can revoke it.

## Allowed networks

Your application may only be called from the networks agreed with Anis. A call from anywhere else is refused as [`insufficient_scope`](https://developers.anis.ly/errors/insufficient-scope.md) — the same answer as a missing permission, on purpose.

## Card codes are secrets

Card codes appear in exactly two places: the answer that first reports a completed order, and a reveal. Store them where you keep secrets, and never write them to logs, traces or error reports.

## Clock

Signatures carry their time, and so do Anis’s answers. Keep your server clock synchronised (NTP): a clock that drifts gets requests refused as [`invalid_credentials`](https://developers.anis.ly/errors/invalid-credentials.md) and answers discarded as too old. Sign for 60 seconds or less — see [Signing requests](https://developers.anis.ly/docs/signing-requests.md#clock).

> **Reporting a security issue**
>
> Write to [info@anis.ly](mailto:info@anis.ly) and quote the request ids involved.