Skip to content

Access token security considerations for Number Verification API#226

Open
jpengar wants to merge 2 commits intocamaraproject:mainfrom
jpengar:jpengar/token-security-considerations
Open

Access token security considerations for Number Verification API#226
jpengar wants to merge 2 commits intocamaraproject:mainfrom
jpengar:jpengar/token-security-considerations

Conversation

@jpengar
Copy link
Copy Markdown

@jpengar jpengar commented Apr 7, 2026

What type of PR is this?

  • enhancement/feature

What this PR does / why we need it:

This pull request updates the documentation for the Number Verification API to clarify and strengthen its authentication requirements. The main focus is on enhancing security by specifying stricter rules for access tokens used in the verification process.

Authentication and Security Enhancements:

  • Added explicit requirements that access tokens for number verification must be single-use, preventing replay attacks and ensuring each token is valid for only one successful API call.
  • Stated that refresh tokens must not be issued for number verification scopes; a new authorization flow is required for each new access token.
  • Limited the maximum expiration time for access tokens to 300 seconds (5 minutes) to reduce the risk window for token misuse.

Which issue(s) this PR fixes:

Fixes #154

Special notes for reviewers:

N/A

Changelog input

 access token security requirements

Additional documentation

N/A

Copy link
Copy Markdown
Collaborator

@bigludo7 bigludo7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Include authentication policy for Number Verification

2 participants