API security

Security controls operate at three points: token issuance, request handling, and outbound webhook delivery.

Grants

Each API client holds grants: the permissions it may use, and the merchants and regions they cover. Every call is checked against the client's grants before any business logic runs. Calls that fall outside them are rejected at the authorization layer.

Tenants manage their clients and each client's grants from the Dashboard. See Account access.

Rate limits

Carriyo applies rate limits at the per-tenant and per-endpoint level to protect availability and prevent abuse. When a client exceeds the applicable limit, Carriyo returns HTTP 429 with a Retry-After header. Integrations should honor that header and apply exponential back-off on repeated throttles.

Webhook authentication

Outbound webhooks are authenticated using credentials the tenant configures on each webhook endpoint. Carriyo supports OAuth 2.0 and API-key authentication, scoped per tenant. You can rotate those credentials at any time from the Dashboard.

Authenticating every outbound delivery gives the receiving system a verifiable guarantee that the call came from Carriyo, and from your tenant specifically, rather than an unknown third party.