Security and permissions
Keep credentials private and make authorization deliberate.
Start in sandbox
Use sandbox credentials for first connections. OAuth preselects Sandbox. A live connection requires deliberate approval and account readiness; a token refresh preserves the original environment.
Match the credential to the task
Use a store key in a store integration, an agent credential for a particular agent, and a developer key for a server integration. Grant only the required scopes. Keep keys in server environments and secret managers; never place them in storefront JavaScript, screenshots or shared prompts.
Review consent
A client chooses its own name. Treat a self-registered client's name and declared profile as claims. Review the return address, permissions and environment before approving OAuth. Cancel if the return address is unexpected.
Preserve owner control
An authenticated agent still needs authority for the purchase. Spending limits, merchant restrictions and owner confirmation may block completion. Resolve the refusal's reason; do not change identities or modes to bypass it. Follow the required idempotency rules for financial writes.
Protect store access
Use HTTPS and validate the installed package's provenance. Keep WordPress, WooCommerce and Shopify integration dependencies current. Store and payment signing identities should survive ordinary upgrades. Do not regenerate production encryption or signing keys to diagnose a connection error.
Separate public documentation from production
This documentation site contains public instructions and URLs. It does not need a production database, Clerk secret, Stripe key or Redis token. Authentication and commerce requests go to the configured platform origin.
Report a problem
Send the affected screen or endpoint, time, environment and a description through your existing mandate0 support channel. Remove secrets, cookies and customer/payment information from evidence. Revoke exposed credentials promptly.