General:

• You may not store any part of the authentication process, to include, but not limited to Username, Password, Security Questions or Answers in your application or backend databases or servers.
  • This is a security best practice. We do not want any elements of the member's credentials stored on the device, vendor's servers, or in the cloud. This can cause account vulnerability
• You may not store any Personal or Financial Information in your application or backend databases or servers.
  • This is a security best practice. We do not want any elements of the member's personal/Financial stored on the device vendor's servers, or in the cloud. This can cause identity theft vulnerability

API Access Keys

• You may not reuse your API Keys between applications or Credit Unions. You will be assigned separate API Access Keys per application you create.
  • Reusing or combining keys restricts our ability to disable the application in the event a vulnerability or issue is identified.
  • It will limit our ability to accurately track usage for the application.
  • It will limit our ability to perform trend analysis.
  • Could impact the API's ability to work correctly with credit union settings.
• You may not share your API Access Key with any other party than yourself.

Access Control: Access is granted on multiple levels.

• By Credit Union. Each Credit Union will have a Vendor list. We have the ability to turn off an entire Credit Union from API access at any time. This would remove access to all Vendors and all Applications for the Credit Union.
• By Vendor. We have the ability to turn on/off a Vendor at any time. This would remove access to each application the vendor has associated with it, but leave the other Vendors for the CU as is.
• By Application. Each vendor will have any applications it publishes assigned an access key to our API's. Turning off an Application would remove access to all API's enabled for the Application.
• By API. Each Application will have API's enabled or disabled based on assignment from CU*A. Access to each of these API's on the Application level can be turned on and off at any time.