Security Recommendations

• Keep API and HMAC keys in a server-side secret manager; never place them in browser or mobile code.
• Terminate every integration over verified TLS and set explicit network timeouts.
• Authorize the customer and operation in your backend before calling OOLIN.
• Generate a fresh nonce and timestamp for every request and keep system time synchronized.
• Store amounts as integer raw units or decimal-safe values.
• Validate account ownership, account status, asset/network activation, destination address, quote, and fees before withdrawal.
• Persist client_request_id before a mutation and recover lost responses before resubmission.
• Redact credentials, signatures, personal data, and sensitive metadata from logs.
• Keep immutable business audit records containing safe identifiers, state changes, actor, and time.
• Apply bounded rate limits and retry policies; unknown errors fail closed.

Customer-facing applications must call your authenticated backend, not Wallet API directly. Your backend checks customer permissions before signing Wallet API requests.

Withdrawal control points

Make a fresh server-side authorization decision close to submission. Bind customer, source account, asset, network, amount, destination, and quote to one immutable business record. Revalidate material fields after a long customer-confirmation wait.

Apply application-level velocity limits and anomaly monitoring in addition to upstream policy. Separate permission to view a transaction from permission to initiate or approve one.

Maintain a credential-rotation runbook, a way to pause new mutations, safe request correlation, and an escalation contact. A pause cannot be assumed to reverse a transaction already submitted to a blockchain.