bizgo Developers

Security policy

This page covers the security policies that keep your use of the Bizgo API safe — API key management, IP ACL setup, enforced HTTPS, and webhook signature verification.

API key security

  • Do not hardcode your API key. Use environment variables or a secret management service.
  • If your key is exposed, reissue it in the console immediately.
  • Keep your development and production API keys separate.
Bash
# 잘못된 예
BIZGO_API_KEY = "your_actual_key_here"  # 코드에 직접 삽입 금지

# 올바른 예 (.env 파일 또는 시크릿 매니저)
BIZGO_API_KEY = os.environ.get("BIZGO_API_KEY")
JavaScript
// 잘못된 예
const apiKey = "your_actual_key_here";  // ✗

// 올바른 예
const apiKey = process.env.BIZGO_API_KEY;  // ✓

IP ACL

The Bizgo API accepts requests only from registered IPs.

  • Whenever your server IP changes, update the ACL in the console.
  • Keep your development and production API keys separate, and register a different IP range for each.
  • You can register IP ranges in CIDR notation: 203.0.113.0/24

If you send a request while the IP is not registered in the ACL, you get an authCode: A050 (IP blocked) response.

Enforced HTTPS

Every API request must use HTTPS.
HTTP requests are rejected.

Webhook signature verification

Bizgo includes an HMAC-SHA256 signature in the webhook request headers.
Always verify the signature to protect against tampering.

The header you receive:

TEXT
x-bizgo-signature: sha256={HMAC-SHA256 signature}

Verification example (Node.js)

JavaScript
const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return `sha256=${expected}` === signature;
}

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-bizgo-signature'];
  const isValid = verifySignature(req.body, signature, process.env.WEBHOOK_SECRET);

  if (!isValid) return res.status(401).send('Unauthorized');

  // 이벤트 처리
  res.status(200).send('OK');
});

Mask sensitive data in error logs

Mask sensitive data such as phone numbers and verification codes in your logs.

JavaScript
function maskPhone(phone) {
  return phone.replace(/(\d{3})\d{4}(\d{4})/, '$1****$2');
}

console.log(`발송 대상: ${maskPhone('01012345678')}`); // 010****5678

Next steps