Credentials
Scoped access
API keys are required for send endpoints and can be rotated from the dashboard.
Security model
Security belongs in every message workflow.
HookMessage separates credentials, workspaces, senders, plan limits, administrative actions, and delivery events so customer communication can be operated with explicit boundaries.
Trust boundaries
01Workspace
02API client
03Sender
04Event receiver
Controls represented in the platform
Concrete boundaries for credentials, capacity, operations, identity, and acceptable use.
Capacity
Plan enforcement
Credit limits are enforced by plan so sandbox and production accounts cannot silently overrun usage.
Operations
Administrative controls
Admins can manage sender status, billing recovery, and workspace security from authenticated dashboard flows.
Identity
Business access controls
SSO and stronger workspace controls are reserved for the Business tier where they fit the current product direction.
Acceptable use
Opt-in communication
The product should stay positioned for opted-in customer communication, not spam or cold outreach.
Request lifecycle
Every accepted request crosses the same control path.
- 01
Authenticate
The backend supplies a scoped API key over HTTPS.
- 02
Authorize
The API checks role, workspace, sender assignment, and active state.
- 03
Enforce
Plan limits and workflow restrictions are evaluated before execution.
- 04
Deliver
The request enters the queue and sender delivery path.
- 05
Verify
Status records and signed webhook events expose the result.
Shared responsibility
Platform controls do not replace secure application design.
Customer responsibility
Your application
- Keep API keys and webhook secrets in server-side environment variables
- Collect consent and send only expected customer communication
- Validate phone numbers and application payloads before sending
- Verify webhook signatures against the exact raw request body
- Restrict internal access to message content and customer records
Platform responsibility
HookMessage platform
- Authenticate API clients and enforce their assigned role
- Keep sender selection scoped to allowed active senders
- Apply workspace plan limits before accepting new sends
- Record message lifecycle state for operational diagnosis
- Sign webhook deliveries and expose credential rotation controls
Operational security controls
What the control does and what an operator should do with it.
Control
Platform implementation
Operator action
API keys
Workspace-scoped clients with OTP or message roles
Create, assign, rotate, revoke, or delete
Webhook events
HMAC SHA-256 signature over timestamp and raw body
Store the secret once and reject invalid signatures
Credential lifecycle
Secrets are revealed on creation or rotation
Replace exposed credentials without recreating the integration
Operational records
Status, delivery, sender, and audit surfaces
Diagnose failures without relying on frontend-only checks
Implementation guidance
Review the controls before production traffic.
Use the security documentation for credential storage, webhook verification, data handling, operational monitoring, and incident-response guidance.