Encryption

The API uses DES encryption to secure certain data while in transit. The DES key is configured in the settings, but must always be 8 ASCII characters long.

DES encryption is done in ECB mode, with padding mode set to zero and the result converted to a base 64 string. There are many tools available online to test this.

Every API call is secured with a token. A token is generated by encrypting the password defined in the integration settings.

It is still recommended that all API calls are made to a deployment’s https bindings for optimal security. Likewise, any callbacks should also be to https URLs if possible for the same reason.