Security

Treat a Torq integration as financial infrastructure. The expected controls are specific to the credential and action boundary, not generic boilerplate.

Credentials

• Store a secret key only in a server-side secret manager. It must never enter browser bundles, mobile logs, URLs, screenshots, or support tickets.
• Use an origin-bound publishable key only in its approved browser origin. It does not grant wallet authority.
• Treat a wallet challenge signature and opaque wallet session as sensitive, short-lived credentials. Do not reuse either.
• Rotate or revoke a key from the Developer Console when a holder, deployment, or environment changes.

Financial operations

Validate the prepared chain ID and simulate the exact intent before signing. Preserve ordered workflow intents, snapshot hash, expiry, and postconditions. If any current authority, freshness, or snapshot check fails, fetch fresh canonical state and prepare again instead of editing calldata.

Event consumers

Verify raw-body HMAC signatures and timestamps, then deduplicate delivery. A valid signature does not make an event exactly-once or globally ordered. Your consumer must be safe when it sees a duplicate, retry, delayed delivery, or cursor replay.

See Authentication and scopes and Errors and rate limits.