Security checklist

Security & operations

Transport

[ ] All calls to AIOTIC over HTTPS (the tenant URL is HTTPS-only).
[ ] Your receive endpoint and webhook URLs are HTTPS with a valid certificate. Self-signed certificates are not accepted.
[ ] If you allow-list source IPs, ask your AIOTIC contact for the tenant's egress addresses and re-check when they change.

[ ] Integration key lives in exactly one place: your order-processing service. Not in browsers, mobile apps, spreadsheets, ERP client scripts.
[ ] Master-data jobs use the sync key, which cannot read or send orders.
[ ] The key you gave AIOTIC for your endpoints is long and random (≥ 24 bytes; aiotic init generates one), stored as a secret, compared in constant time.
[ ] Separate keys per environment (test tenant vs production tenant vs your ERP test/prod).
[ ] Rotation procedure written down: who asks AIOTIC for a new integration key, how the sync key is rotated by a tenant admin, how you rotate your endpoint key (configure the new one in AIOTIC first, accept both briefly, drop the old one).
[ ] Logs never contain key values. Log "auth failed" and the source IP.

[ ] Reject missing or wrong X-API-KEY with 401 before parsing the body.
[ ] Parse JSON with a schema (the SDK models); reject unknown shapes with 400 and success: false.
[ ] Idempotent on request_id; body size limited (an order is kilobytes, not megabytes).
[ ] Never execute or interpret text from the payload: descriptions, notes and addresses are customer-written free text. Treat them as data in SQL (parameters, never string concatenation) and in any downstream template.
[ ] Rate-limit and alert on bursts of 401s (probing).

[ ] Client-side rate limit (SDK default 10 req/s) and bounded concurrency in sync jobs.
[ ] Timeouts and retries with backoff; no infinite retry loops on 4xx.
[ ] Only the fields you intend to sync leave your ERP (no prices, margins, credit data in remark).

[ ] Purchase orders contain personal data (contact names, e-mails, phone numbers). Apply your retention policy to what you store from payloads and downloaded artifacts.
[ ] Do not copy AIOTIC artifacts (original PDFs) into systems that are not part of your order process.
[ ] Support tickets: share request_ids, not payloads, unless the channel is approved for personal data.

[ ] Use the docs-mode MCP server (public docs only) freely. Enable tenant mode only on a developer machine, only against the mock or a test tenant, with write tools disabled unless needed. See MCP server.
[ ] Never paste keys into prompts or chat tools. The SDK reads them from the environment for a reason.