Additional security mechanisms
Use the mechanisms below for greater security in your account.
Add extra layers of security to your integration
In addition to the API key, Asaas offers additional mechanisms to protect account access and the operations performed by the integration.
We recommend configuring at least one of them and, whenever possible, using both together.
Available mechanisms
| Mechanism | Protection offered |
|---|---|
| IP whitelist | Restricts the use of the API key to authorized IP addresses |
| Withdrawal authorization via Webhook | Lets your application approve or refuse outgoing operations before processing |
IP whitelist
The whitelist limits API requests to the registered IP addresses.
Requests originating from other IPs are rejected with 403 Forbidden.
Even if an API key is compromised, it cannot be used outside the authorized infrastructure.
Withdrawal authorization via Webhook
This mechanism lets your application validate outgoing operations before they are processed by Asaas.
After the request, Asaas sends a Webhook to the configured endpoint. Your application must verify the data and respond by approving or refusing the operation.
If the operation is not recognized or not approved, it will be canceled.
Configure withdrawal authorization via Webhook.
The mechanisms are complementary.
The whitelist restricts the origin of requests, while the Webhook lets you validate each operation before processing.
Next steps
Updated 2 days ago