Keys and access

Values

Value	Secret	Where to keep it	If it is compromised
Site key	No	The page’s source code	The impact is limited. In the browser it only works on your verified domains and reads reviews that are already public. It cannot be used to write reviews; writing a review requires purchase verification.
Server key	Yes	Only on your store’s server, as a secret configuration value	The most serious case. Whoever obtains the key can send orders on your behalf; fake orders can be used to have “verified” reviews written. They can also make the signed-in customer query for any customer email address: they learn whether the address bought a product and whether it wrote a review, and, if they know the order number, the items of the order; if the customer can write a review, they obtain a review writing token on that customer’s behalf. Keep the key on the server only; if it has been exposed, cancel it immediately. A server key created in the panel cannot call the Admin API.
Signing password (optional)	Yes	Only in your order system	Like the server key: whoever obtains the password can send orders on your behalf. Do not create one if you do not use it.
Notification address password	Yes	In the system that receives the invitations	Whoever obtains the password can send requests to your system as if they came from Sayproof.
Email delivery events password and addresses containing an access code	Yes	In your email service’s settings	Fake delivery or bounce events can be sent; addresses can be added to the list of people who do not want emails.
Password setup link	Yes	Only with the account owner: it is sent to the account’s email address and is not shown on screen	A person who gets hold of the link can use it once, within its validity (3 days for a new-account link, 1 hour for a reset link), to set the password of the account concerned. If two-step sign-in is on for the account, the password alone is not enough to sign in.

Storage at Sayproof

• The full server key is shown only once, at the moment it is created. Sayproof does not store the key itself, only a hash sufficient for verification.
• Passwords are likewise shown only at the moment they are created; they cannot be viewed in the panel afterwards.
• The login details of product sources and order connections are stored encrypted and are not shown on screen again.
• Keys, passwords, signatures and email addresses are not written to logs; [redacted] or a hash value is written in their place.

Measures on your side

• Do not put secret values in source code, code repositories, environment variables exposed to the browser (NEXT_PUBLIC_…), logs or messaging tools. Use your server’s secret configuration store (secret manager).
• Create a separate key for each system and environment, and give it a meaningful name (for example “store server – live”, “order transfer – test”). If one key is compromised, you then only need to cancel that key.
• If an agency did the setup or someone has left the team, renew the keys and passwords.
• Give users only the role their work requires; limit the Administrator role to a small number of people.

When a key is compromised

1. On the Keys tab of the Channels screen, cancel the key or password concerned immediately with the Cancel button. Signing passwords are in the Advanced: signing passwords section on the same tab. Cancellation cannot be undone and takes effect immediately.
2. Create a new key or password and update it in your system.
3. Review unexpected requests on the Activity history and Connection log screens. If the server key or a signing password was compromised, check the Recent requests list on the Integration › Order transfer tab and the orders received during the period concerned.
4. Inform the Sayproof team and review the reviews written during the period concerned.

To renew without interruption, first create and deploy the new key, then cancel the old one.

Panel access

• Only users with the Administrator role and the Sayproof team in a time-limited support session can perform channel, domain, key and password operations. These operations cannot be performed with any server key; they can only be performed in a panel session.
• The invitation delivery settings (the sending route, the notification address, the sender email address and the support page address) and a channel’s sender address and support page in the Edit the channel form can also only be changed in a panel session. This way a compromised key cannot redirect invitations and customer email addresses to another system.
• Only the Sayproof team can create keys that carry the change settings (write) permission.
• Every key and password creation or cancellation is recorded on the Activity history screen, together with the user who performed it.
• The brand’s last administrator cannot be demoted, and the user cannot be removed.
• All brands sign in to the panel at the same address; the account decides which brand opens, and a user belongs to exactly one brand. Every request in the panel is bound to the user’s brand, and the database returns only that brand’s records: Panel address.
• The Sayproof team is not a user of the brand; the time-limited session it opens for support shows in the Activity history with its reason: Sayproof team support access. The team’s own management screen always takes two steps to sign in.
• Users can turn on two-step sign-in for their own account. Password links go only to the account’s email address and are not shown to the person who asked for them; when a password or an email address changes, a notice goes to the account’s address: Sign-in security.
• For login rules and roles, see Users and roles.

Set strong passwords for administrator accounts that are used only for that account, and turn on two-step sign-in: Two-step sign-in.