Security

We are very serious about security and we keep your data secure in flight and at rest.

• We will only allow access to the API over HTTPS in all environments.
• In the production environment you can only access the API if your IP address is part of the allow list. We will guide you through this process.
  • In order to access the API, you must provide proof that you say who you are. This requires you to include a calculated signature in the authorization header when making requests. The authentication - the process is described here: Authentication

🚧

Security is everyone's responsibility

It is your responsibility to securely store values (keys and secrets) that are used to authenticate you.

• In Sandbox - the IP listing is not required.
  • The API endpoint can be authorised by using the bearer token.
• In Production - the IPs must be registered with Merge before go-live.
  • As part of go-live, once the Sandbox integration has been reviewed and approved the next steps to go-live will be initiated to register your production IPs.