Access and credentials
Who can issue, use, rotate and revoke access? How are environments separated, and how does your team confirm it is using the intended account?
Authentication planningSecurity
Keep credentials out
of the public request.
Use the APISMA website to evaluate the service and introduce your business. Share account-specific security and integration information only through the appropriate confirmed private channel.
What happens at the boundary
A request is not an account.
The public form is for business qualification. It is separate from partner access and operational integration.
- 01
Business details
The form asks for name, work email, company, role, integration categories and expected volume. Do not add secrets or customer records.
- 02
Server-side verification
The request flow validates the anti-abuse challenge before acknowledgement and operator notification. A failed submission is not proof that a request was accepted.
- 03
Human decision
An operator reviews the request. Submitting it does not issue credentials or guarantee approval; any approved access follows separately.
Information handling
Send enough business context.
Keep sensitive data out.
A useful introduction does not require your production configuration.
| Appropriate for qualification | Keep in a confirmed private channel |
|---|---|
| Company, role and work contact | API keys, access tokens, passwords and private keys |
| Categories and an expected volume range | Customer records, player details, phone numbers or usable codes |
| A general description of your business case | Production logs, account identifiers and internal configuration |
If your security team needs to discuss a sensitive requirement, describe the requirement without attaching the sensitive material. Confirm the recipient and transfer method first.
Questions for private review
Ask for evidence that matches
your actual integration.
These are due-diligence topics, not assertions that a particular APISMA control or certificate is in place.
Data and retention
Which personal or product data crosses each boundary? Clarify recipients, retention, deletion and what your own systems must avoid logging.
Privacy and data handlingIncident response
Which confirmed contact should your team use, what evidence is safe to send, and how are responsibilities divided during an incident? Do not assume a response-time commitment.
Integration safeguards
Discuss duplicate prevention, uncertain outcomes, reconciliation and callback verification where applicable. Require the relevant private contract before implementation.
Integration planning topicsFor approved partners
Use the contact issued to your team.
The public access form is not an incident desk and should not receive account details.
Check your existing agreement and onboarding records for the approved support or security contact. If you suspect a credential has been exposed, use your organization’s incident procedure and the confirmed partner channel; do not repost it in a public inquiry.
Contact guidance