Security

Rezva uses scoped credentials, controller authorization, safety periods, fail-closed statuses, and audit events to protect payment mappings.

Integration requirements

• Keep provider and Free API keys on a trusted server or secure wallet runtime.
• Validate response status and payment readiness before payment.
• Warn on pending, recently changed, suspended, and removed mappings.
• Never infer ownership from a provider credential.
• Do not cache transitional or payment-critical state for long periods.

Threat controls

Resolver traffic is authenticated, rate-limited, monitored for enumeration, and separated from registry mutations. Complaints create review work; they do not silently change registry state. Privileged actions and ownership decisions must be auditable.

Request handling checklist

1. Keep API keys in a server-side secret store or protected wallet runtime.
2. Redact Authorization and controller headers from logs.
3. Use TLS and set a bounded request timeout.
4. Honor Retry-After instead of retrying a 429 in a tight loop.
5. Do not cache pending, suspended, removed, or update-pending results as payable.
6. Verify the chain receipt and token transfer before showing payment received.