Tango API security best practices

Authenticate every Tango API request from a trusted server-side environment. Protect your credentials and use transport and network controls where your platform needs them.

Start with these controls

1. Call the API from a trusted server-side environment: Browser-based requests are not supported and may produce a 403.001 authorization error or a Cross-Origin Resource Sharing (CORS) error.
2. Choose an authentication method: Use Basic Auth with your platform name and API key, or OAuth 2.0 client credentials with a client ID and client secret to obtain an access token. Authenticate every API request. For help choosing a method, see Secure your connection with Tango API.
3. Protect credentials and verify the TLS connection: Store API keys and client secrets in a secrets-management solution, and ensure your runtime validates Tango's server certificate chain. Rotate API credentials at least every 90 days and immediately after a suspected compromise.
4. Enforce account access in your application: Tango validates the identity of the calling platform but does not manage authorization between accounts within your platform. Your application must prevent users of one account from placing orders on behalf of a
5. Handle request failures safely: Set client timeouts to at least 15 seconds. Use a unique externalRefID for each order transaction, reuse it when retrying that transaction, and increase the wait between retries.