Skip to main content

Production Best Practices

Security Checklist​

1. HTTPS​

Always use HTTPS when communicating with the Kyqu API. The client SDK uses fetch and respects the protocol of the baseUrl.

2. Session Token Storage​

Store bearer tokens securely:

  • Web apps: Use HttpOnly cookies if you have a backend, or secure localStorage with proper CSP headers
  • Mobile apps: Use the platform's secure keychain (iOS Keychain, Android Keystore)
  • Node.js/Bun/Deno: Keep tokens in memory or environment variables — never log them

3. Token Validation​

Validate the user's session on app startup:

try {
  const user = await kyqu.getUser(token);
  // User is authenticated
} catch {
  // Token expired or revoked — redirect to login
}

4. Handle TOTP 2FA​

Always handle the TOTP_REQUIRED error in your login flow:

try {
  const { user, session } = await kyqu.login({ email, password });
} catch (err) {
  if (err.status === 403 && err.data?.error === "TOTP_REQUIRED") {
    // Prompt user for their 2FA code
    const { user, session } = await kyqu.login({ email, password, totpCode });
  }
}

5. Verify Webhook Signatures​

If your app receives Kyqu webhooks, verify the HMAC-SHA256 signature:

import { createHmac } from "node:crypto";

function verifyWebhookSignature(payload, signature, secret) {
  const expected = createHmac("sha256", secret)
    .update(JSON.stringify(payload))
    .digest("hex");
  return `sha256=${expected}` === signature;
}

6. Rate Limiting​

Kyqu applies rate limits on credential endpoints. Handle 429 Too Many Requests responses gracefully in your integration.

7. Monitor Webhook Events​

Subscribe to key auth events to keep your systems in sync:

EventAction
user.suspendedRevoke access in your app
user.reactivatedRestore access
user.password_resetInvalidate active sessions
user.totp_enabled / user.totp_disabledUpdate 2FA status display

8. Use Auto-Refresh​

Wrap sessions with withAutoRefresh() to avoid expired token errors:

const managed = kyqu.withAutoRefresh(session, {
  marginSeconds: 60,
  onError: () => redirectToLogin()
});

9. CORS Configuration​

For browser-based integrations, configure allowedOrigins in your project's auth settings to restrict which origins can call the Kyqu API.