Security Model
Key scoping, privacy posture, and fail-closed boundaries.
SDK API keys
- Mobile SDK clients are public clients. SDK API Keys are not secrets.
- Only key hashes are stored server-side. Raw keys are shown once at creation.
- Keys are sent only in Authorization: Bearer headers. Never in URLs.
- Scoped by Tenant, Environment, allowed SDK App IDs, and SDK Scopes.
- Support revocation and rotation without SDK redeploy.
Environment isolation
All three must agree for any SDK request:
- SDK Base URL host resolves to the correct Domain and Environment.
- API Key belongs to the same Environment.
- SDK App ID belongs to the same Environment.
Mismatches return a generic auth or no-match response. Cross-environment details are never leaked.
Privacy model
- Deterministic matching only by default.
- No raw IP storage. No full user-agent fingerprint storage.
- Short Click Context TTL with aggressive expiry.
- No tenant ID in SDK response metadata.
- No clipboard attribution by default.
- Probabilistic matching requires explicit tenant opt-in.
Hashing is not a privacy escape hatch. Hashed identifiers can still be tracking identifiers when linkable.
Admin API security
- Admin Users access tenants through Tenant Memberships with fixed roles.
- All config writes affecting domains, links, and association files are audited.
- Config is published through explicit versions for review and rollback.
- Rate limiting by key, SDK App ID, domain, IP bucket, and anomaly signals.