Skip to main content
Enable Secure Mode, manage Server & API keys, add mTLS, and compare authentication modes to harden access to Social Plus APIs.

Secure Mode

Require backend mediation

Server Key

One-time secret generation

API Key

Network identifier

mTLS

Mutual certificate auth

Auth Modes

Capability comparison

Governance

Rotation & auditing

​
Secure Mode Overview

Without Secure Mode, a client app exchanges API key + userId directly for a long‑lived access token (higher abuse risk). Secure Mode inserts your backend to mint a short‑lived auth token using the Server Key; the client then redeems it for an access token.
Always enable Secure Mode in production; unsecure mode is for local testing only.

​
Enable Secure Mode & Generate Server Key

1

Navigate

Console → Settings → Security (Integrations tab if grouped).
2

Toggle Secure Mode

Confirm impact dialogue.
3

Generate Server Key

Displayed once—copy immediately.
4

Store Secret

Place in secrets manager (Vault / KMS). Never commit.
5

Implement Backend

Add token exchange endpoint using Server Key.
Use a non Super‑Admin admin account to generate the Server Key.

​
Authentication Modes

Client uses API key + userId → access token (30d). Simplicity, low security.

​
Key & Token Concepts

Public identifier for network; OK in client; no user identity.
Backend-only secret used to mint auth tokens; rotate periodically.
Short-lived token (~10 min) created via Server Key proving backend mediation.
Longer-lived user session (~30 days) returned after auth token redemption.

​
mTLS Certificates

1

Prerequisite

Secure Mode enabled.
2

CSR Creation

Generate CSR (CN = service identity).
3

Upload CSR

Settings → Security → “+ Create Certificate”.
4

Issue & Activate

After issuance, enable mTLS toggle.
5

Deploy Cert

Install cert & private key on backend only; keep outside repo.
Maximum 2 active certificates; upload new before disabling old to achieve zero-downtime rotation.

​
Governance & Rotation

Annually or on suspicion; parallel run new & old ≤1h.
Track expiry; renew ≥30 days prior.
Log auth token generation events (userId, timestamp) but never secrets.
If key leak: revoke, rotate, invalidate suspicious sessions.

​
Metrics

​
Troubleshooting

​
Quick Reference

Production Baseline

Secure Mode ON

High Assurance

Add mTLS

Rotate Key

≤12 months

Cert Renewal

≥30 day lead

Admin Tokens

Lifecycle management

Integrations

Webhooks & Push

Branding

Logo & brand account

Admin Access

Role governance