- Home
- Blog
- API & Integration
- eSIM API Security: Protecting Your Balance, Keys and Customer Data
eSIM API Security: Protecting Your Balance, Keys and Customer Data
eSIM API security protects the prepaid balance that pays for every eSIM you order. Use scoped API keys, keep test and live keys separate, restrict live keys to your servers with an IP allowlist, turn on two-step sign-in, verify webhooks and give each team member the smallest role they need. Fully Signal provides all of these controls in the partner panel.
In this article
Your eSIM API key can spend money. Anyone who has it can order eSIMs from your balance. That makes eSIM API security a business issue, not just an IT one. This checklist covers the controls every reseller should switch on before going live.
What is at risk
| Asset | Risk if exposed |
|---|---|
| Live API key | Unauthorised eSIM orders from your balance |
| Partner panel login | Orders, refunds, settings changes |
| Webhook endpoint | Fake events that confuse your systems |
| Customer data | Names and emails tied to orders |
1. Separate test and live keys
Build and test with sandbox keys only — nothing is charged and sample data is used. Create live keys only for production servers. Never paste a live key into a test environment, a shared document or a chat. More: sandbox testing.
2. Use scoped API keys
Give each key only the permissions it needs. A key that only reads the catalogue for your website should not be able to place orders. Fully Signal supports scoped API keys, so you can create a read-only key for catalogue sync and a separate order key for checkout.
3. Restrict live keys with an IP allowlist
Allow API calls only from your server's IP addresses. A leaked key is then useless from anywhere else. Update the list when you change hosting.
4. Never put keys in front-end code
Mobile apps and browser JavaScript can be inspected. Always call the eSIM API from your server, and let your app talk to your server.
Phone app → your server (holds the key) → eSIM API5. Turn on two-step sign-in
Every panel user should use two-step sign-in. Most account takeovers start with a reused password.
6. Give team members the right role
Invite colleagues with their own sign-ins instead of sharing one login, and give each the smallest role they need — support staff can look up orders without changing billing or API keys. Remove access the day someone leaves.
7. Verify webhooks
Treat incoming webhooks as untrusted until verified. Fully Signal signs every webhook with HMAC-SHA256 over the timestamp and raw body, using your webhook secret: recompute the signature, compare it, and reject old timestamps so a captured request cannot be replayed. Use HTTPS, and make handlers idempotent so a repeated event is harmless. See eSIM webhooks.
8. Monitor spend
- Low-balance alerts warn you before the balance runs out.
- Monthly statements and transaction downloads show every movement.
- Compare daily order counts with your own sales; a sudden spike you did not sell is a red flag.
Our idempotency and error handling guide explains daily reconciliation.
9. Rotate keys
Rotate live keys on a schedule and whenever staff with access leave. Store them in your server's secrets manager or environment settings, never in source code.
Security checklist
| Control | Fully Signal |
|---|---|
| Separate sandbox and live keys | Yes |
| Scoped API keys | Yes |
| IP allowlists | Yes |
| Two-step sign-in | Yes |
| Signed webhooks (HMAC-SHA256) | Yes |
| Team access with roles | Yes |
| Low-balance alerts | Yes |
| Monthly statements | Yes |
FAQ
Why does eSIM API security matter?
Because a live API key can order eSIMs that are paid from your prepaid balance. A leaked key can cost real money.
Should I call the eSIM API from my mobile app?
No. Keep API keys on your server and have the app talk to your server, never directly to the eSIM API.
What is an IP allowlist?
A list of IP addresses allowed to use an API key. Requests from any other address are rejected.
What are scoped API keys?
Keys limited to specific permissions, such as reading the catalogue but not placing orders.
What should I do if my API key is exposed?
Revoke it in the partner panel straight away, issue a new key, update your server and check recent orders.
