Additional security mechanisms
Use the mechanisms below for greater security in your account.
Add extra layers of security to your integration
In addition to the API key, Asaas offers additional mechanisms to protect account access and the operations performed by the integration.
We recommend configuring at least one of them and, whenever possible, using both together.
Available mechanisms
| Mechanism | Protection offered |
|---|---|
| IP whitelist | Restricts the use of the API key to authorized IP addresses |
| Withdrawal authorization via Webhook | Lets your application approve or refuse withdrawal operations before processing |
IP whitelist
The whitelist limits API requests to the registered IP addresses.
Requests originating from other IPs are rejected with 403 Forbidden.
Even if an API key is compromised, requests originating from unregistered IPs will be rejected.
Withdrawal authorization via Webhook
This mechanism lets your application validate outgoing operations before they are processed by Asaas.
After the request, Asaas sends a Webhook to the configured endpoint. Your application must verify the data and respond by approving or refusing the operation.
The operation will be canceled if your application responds with REFUSED, returns a response without a valid status, or if the webhook call fails three consecutive times.
Configure withdrawal authorization via Webhook.
The mechanisms are complementary.
The whitelist restricts the origin of requests, while the Webhook lets you validate each operation before processing.
Next steps
Updated 9 days ago