Skip to main content

Security Best Practices

Recommendations for securing your Pelago integration.

API Key Security​

DO ✅​

  • Store keys in environment variables
  • Use different keys for sandbox/production
  • Rotate keys every 90 days
  • Use scoped keys when possible

DON'T ❌​

  • Commit keys to version control
  • Share keys via insecure channels
  • Expose keys in client-side code
  • Use production keys in development

Webhook Security​

  1. Always verify signatures
  2. Check timestamps (reject stale webhooks)
  3. Process asynchronously (respond quickly)
  4. Implement idempotency (handle duplicates)
const isValid = pelago.webhooks.verify(
  payload,
  signature,
  timestamp,
  secret
);

Infrastructure​

  • Enable HTTPS everywhere
  • Use IP allowlisting if possible
  • Implement rate limiting
  • Monitor for anomalies

Wallet Security​

  • Use hardware wallets for large amounts
  • Implement multi-sig for withdrawals
  • Regular security audits
  • Keep software updated

Incident Response​

  1. Detect: Monitor logs and alerts
  2. Contain: Revoke compromised keys
  3. Investigate: Review access logs
  4. Recover: Rotate all credentials
  5. Report: Contact security@pelago.tech