Security

Authentication

All TrackLogy API endpoints require authentication. Two authentication schemes are used depending on the integration type:

JWT tokens are short-lived and are invalidated on password change, logout, and account deactivation. Each device or session receives a unique JTI (token ID) that can be individually revoked without affecting other active sessions.

API Keys

• Account API keys are shown in Dashboard → Settings → API Keys
• Store-scoped keys are deprecated — use account-level keys with the X-API-Key header for all Cloud API integrations
• Rotate your key immediately if you suspect it has been exposed
• Never embed API keys in frontend code, client-side JavaScript, or public repositories

Webhook Signatures

Every outgoing webhook request is signed with HMAC-SHA256 using your store's webhook_secret. The signature is included in two headers:

• X-TrackLogy-Signature: sha256={hmac_signature}
• X-Hub-Signature-256: sha256={hmac_signature} (GitHub-compatible)

Always verify the X-TrackLogy-Signature header before trusting or acting on a webhook payload. See Webhooks → for code examples in PHP and Node.js.

HTTPS Only

All API communication is over HTTPS. HTTP requests are rejected. Webhook endpoints must also use HTTPS — HTTP webhook URLs are not accepted.

Data Isolation

Each workspace is fully isolated at the data layer. Users can only access their own shipments, stores, notification settings, and billing information. Team members can only access workspaces they have been explicitly invited to.

Input Validation

All API inputs are validated, sanitized, and type-checked server-side before any database operation. The API uses parameterized database queries (Medoo ORM with prepared statements) — SQL injection through the API layer is not possible.

Two-Factor Authentication (2FA)

Enable 2FA from Dashboard → Settings → Security. TrackLogy uses TOTP (time-based one-time passwords), compatible with Google Authenticator, Authy, 1Password, and any RFC 6238-compliant authenticator.

When 2FA is enabled, your password alone is not sufficient to log in — a valid TOTP code from your authenticator app is also required.

Security Headers

The TrackLogy API responds with the following security headers on all responses:

Responsible Disclosure

If you discover a security vulnerability in TrackLogy, please report it by email before disclosing publicly:

Email: [email protected]

Include a description of the issue, steps to reproduce, and any relevant technical details. We will respond within 48 hours and work to address the issue promptly.