help.security.title

help.security.apiKeyTitle

help.security.apiKeyText

help.security.totpTitle

help.security.totpText

1. help.security.totpStep1
2. help.security.totpStep2
3. help.security.totpStep3
4. help.security.totpStep4

help.security.totpHeaderNote

curl -X POST https://api.apertur.ca/v1/sessions \
  -H "Authorization: Bearer aptr_xxxx" \
  -H "X-APTR-TOTP: 123456" \
  -H "Content-Type: application/json" \
  -d '{ "delivery_mode": "webhook", "webhook_url": "https://..." }'

help.security.mtlsTitle

help.security.mtlsText

1. help.security.mtlsStep1
2. help.security.mtlsStep2
3. help.security.mtlsStep3
4. help.security.mtlsStep4
5. help.security.mtlsStep5

# cURL with client certificate
curl -X POST https://api.apertur.ca/v1/sessions \
  --cert client.crt \
  --key client.key \
  -H "Authorization: Bearer aptr_xxxx" \
  -H "Content-Type: application/json" \
  -d '{ "delivery_mode": "webhook", "webhook_url": "https://..." }'

help.security.passwordTitle

help.security.passwordText

curl -X POST https://api.apertur.ca/v1/sessions \
  -H "Authorization: Bearer aptr_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_mode": "webhook",
    "webhook_url": "https://your-app.com/webhook",
    "password": "claim-4521-pin"
  }'

help.security.passwordHashNote

SDK Origin Validation

When using the aptr-connect SDK, you can restrict which domains are allowed to use your public key by configuring allowed domains on your OAuth app. The server validates the Origin header of incoming requests against your allowed domains list.

Wildcards are supported: *.example.com matches any subdomain at any depth. Leave the list empty during development to allow all origins.

Configure allowed domains in your partner OAuth app settings.

help.security.webhookSigTitle

help.security.webhookSigText

const crypto = require("crypto");

function verifyWebhook(body, signatureHeader, secret) {
  const expected = "sha256=" +
    crypto.createHmac("sha256", secret)
      .update(body)
      .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

// In your Express handler:
app.post("/webhook", express.raw({ type: "*/*" }), (req, res) => {
  if (!verifyWebhook(req.body, req.headers["x-aptr-signature"], WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }
  // Safe to process...
  res.status(200).end();
});

import hmac
import hashlib

def verify_webhook(body: bytes, signature: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

help.security.accountTitle

help.security.accountText