Aera signs what it sends. Check signatures with Aera's public keys, use HTTPS and keep credentials secret.
Master: api-docs.aerahost.comWe're moving our API docs to docs.aera.id. Until the move is done, 20. Security, 20.3.2. Data in Transit and 20.6. Security Incidents on api-docs.aerahost.com are the master for this page. If this page and api-docs differ, api-docs is right.
Verify signatures
Aera signs every request and response it sends, including webhooks. The signature is in the Signature header. Check it with Aera's public key for the environment, so you know the data comes from Aera and hasn't been changed.
Public key: staging (customer test)
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv0DmcZCsOF0Kvrg460utqCTM7EZcmr1
p3aB+Mlqds5j7ID6epZQj/Scfh5owlfPWcYaCpjY6OnF7SJHP5RqzQl9JI0YKcvFkDeu1nHA6e5
A7yhemHgjTS4iO0dHVfbcGlqELeragafNHZwKqqvu+ZYZtvmOTseiLo//wRWlDUurBETAxjveLy
1/BzUkFZRKPII8owU6U7t3Jlrtwb6KontLm89SnUhXRe8HjXK1xN/2JA/q/YX4ketTWbV0yi8js
eGSfeNsDGApdXYsLoclYsbyOlVJXBVHOtqQoXNGd5dSKTJ5dewsWXzeRmIWMvDFifzDsp+uWZQm
F1/zsieJUrwIDAQAB
-----END PUBLIC KEY-----Public key: production
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1tAzWBa9pY5WUfLLVpiL53BirmW144O
GzgYrOWt5hQjZQevE6fuN3gDhGjtNVHGx8Fn+im5IOwDo+1USYGIM15xzzmuRmEQ8jd8154IZu/
TIhfhx+WbsTMVb0U0TfSrD8GFBgGt6IZnDR8k/jt0wYqEVaoeZPRzkeGFfbUQXH446ZyolH+ATk
e8AtaWq8VKoqHNWS5FeOYdg2EGGmi0er3Kn6+9/XvIkx4KhrvKr0FdBoXXvaLOY/ZCa7oS7zZ6r
blHYDV1xHGEhcy1T+tkmg3ACX206FnNnsdBx21SdhBzjjGSsUmS9Jkc2mzwxTk8ElJHlD56vLXG
mnmYGSefQTQIDAQAB
-----END PUBLIC KEY-----Keep your integration secure
- Use HTTPS for every request.
- Keep your API key, client ID and client secret secret. Don't put them in code that runs in a browser or app.
- For webhooks, check both the API key and the signature before you trust the request. See Step 3: Check every request.
Report a vulnerability
Found a security issue in Aera's services? Email [email protected].