Security requirements

​

Protect your API key

• Never expose it in code. Don’t hardcode it in source files, commit it to source control, or include it in client-side code, mobile apps or browser requests. Call the Melio API only from your server.
• Store it in a secure location. Keep it in a secrets manager, such as AWS Secrets Manager, Google Secret Manager, Azure Key Vault or HashiCorp Vault, and load it at runtime.
• Restrict access. Give access to the key only to the services and people that need it.
• Keep it out of logs. Never log the key, and don’t include it in error messages, support tickets or screenshots.
• Generate a new key immediately if you suspect the key has been exposed.

​

Authenticate your users

​

1. Multi-factor authentication (MFA)

• Require MFA for every user, with no exceptions.
• Supported methods are authenticator apps (preferred), passkeys and SMS.
• Ask for MFA again on every new device and at least every 30 days.
• Don’t let users skip, disable or downgrade MFA.

​

2. Passwords

• Enforce a minimum length and check passwords against breached and commonly used lists. Don’t impose arbitrary composition rules or forced periodic changes.
• Limit failed login attempts, add bot protection, and store passwords only with a modern adaptive hash (Argon2id, scrypt or bcrypt).

​

3. Sessions

• Use unguessable server-generated session IDs. Set inactivity and absolute session timeouts that fit the risk of the actions a user can perform.
• Mark cookies Secure, HttpOnly and SameSite, and invalidate sessions on logout, password reset and credential change.
• Let users see and end their active sessions, including “log out everywhere”.

​

4. Account recovery and changes

• Make password and MFA reset at least as hard as logging in. Never let an email link alone bypass MFA.
• After a reset, end all existing sessions and require a full login. Notify the user out of band, and require MFA to change email, phone or other recovery details.

​

5. Users and access

• Each person has their own login. Never share accounts.
• Removed users lose access immediately, and all their sessions and tokens are revoked.
• Enforce permissions on the server for every request, on the principle of least privilege.

​

6. Logging

• Log logins, failures, MFA events, resets and permission changes.
• Never log passwords, codes or API keys.
• Alert on suspicious patterns.

​

Protect data and your connection to Melio

• Use HTTPS only. Connect to the Melio API only over TLS 1.2 or higher, validate certificates, and never disable verification. Serve your own pages and assets over HTTPS with no mixed content, and test with a tool such as Qualys SSL Labs.
• Minimize what you store. Keep only the Melio data you need, for as long as you need it. Don’t store sensitive payment details such as full bank account or card numbers unless you must. If you do, encrypt them at rest and restrict access.
• Don’t trust inputs. Validate and encode everything that comes from users and from API responses to prevent injection and cross-site scripting. Use parameterized queries.
• Handle errors safely. Don’t show raw API errors, stack traces or tokens to end users.
• Protect your web app. Use a Content Security Policy, avoid loading third-party scripts on pages that handle payments, and keep third-party JavaScript to a minimum, since a compromised script can act as your page.
• Respect rate limits and retries. Retry 429 and 5xx responses with exponential backoff, and send an Idempotency-Key header on payment-creating requests so a retry never creates a duplicate payment. See Idempotency and Status codes.