4 ms·
Can someone from Standard Treasury comment on the security model they are using for these API's?
by marcell 13y ago
Can someone from Standard Treasury comment on the security model they are using for these API's?
- zt 13y agoThis question is one we're still answering with banks. The exact security model will likely differ slightly by bank, depending on their idiosyncratic wishes and standards. Also, the security model could be broken down in to (a) How do we talk to the banks (b) How is our system secured and (c) How do end-developers talk to our systems. For the last one, which is what I think you're asking, it seems like our bank partners will settle on (1) a long, random, high-entropy API secret key (like Stripe) or SID/auth token combo (like Twilio) or (2) Both the secret key AND something like OAuth because banks really want multi-factor authorization. But again, nothing is set yet.