Comment by yashmaistry

That's true, it doesn't make it obvious.

We handle security in a few ways;

- Clients are initialised with Key & ID - We advocate for keys to not be hardcoded

- The key is used for request encryption and are never sent to the server. Request hashes are also used to make sure Man In the Middle Attacks are avoided

- Custom Auth Tokens can be sent with requests - On the server side we use your provided auth callback to ensure it is valid

What do you think about the steps we take? Tokens are really important because they offer another layer of protection