Developer API security best practices
Protect tokens, use separate connections, keep logs, and avoid cross-company mistakes.
Use separate connections
Create separate connections for n8n, website, online store, and delivery partner. This makes logs clear and lets you pause or regenerate one token without affecting others.
Protect tokens
- Never place API tokens in public browser JavaScript.
- Store tokens only in server-side code or secure automation credentials.
- Regenerate a token immediately if it is exposed.
- Use idempotency keys for order creation and payment updates.
Company isolation rule
Do not trust company_id from external payloads. BOS already resolves the company from the connection itself.