...
Transport Level Security
The API interfaces require the use of a URL . It is important that you of the SurePassID Authentication Server (SAS). You must use the HTTPS: and not HTTP. The MFAS SAS will not accept HTTP requests. All access should use TLS 1.2 or greater.
Sever to Server Communications Only
This API is used for server to server communications only. The API contains sensitive information that you would not expose in a non-secure environment such as a mobile app. Mobile apps invoke requests on the SurePassID REST proxy interface and the proxy forwards that request to SurePassID. All browser based JavaScript operations will talk to a proxy page on your site, which will in turn communicate with the SAS server. All mobile apps will also talk to a proxy page on your site, which will in turn communicate with the SAS. We have sample code that does all of this for you.
IP White Listing
It is strongly recommended that you limit access to your MFAS your SAS accounts from applications on a trusted IP/domain. In the MFAS the SAS server you can specify a white list access list of IP addresses that are valid for your account. Alternatively, the MFAS SAS does support certificates for apps using web services and WCF applications. Contact us for more information on configuring this level of security.
...
Account Info
Keep you account login info in a safe place and never in plain text. Always obfuscate/encrypt the Login Name and Login Key in your server applications that interface with the SAS.