Interfaces carry exactly the data a company least wants to lose: customer records, prices, orders, invoices. This category covers securing those connections — authentication and key management, permissions following the principle of least privilege, encryption in transit, rate limiting, logging and reviewing access. Added to this are organisational questions: who may create credentials, how are they revoked when service providers change, and what does an emergency procedure look like on suspicion of compromise? We also address requirements from data protection and security regulation and describe test steps that can be repeated on a regular schedule. We additionally cover how to log interface access without unnecessarily storing personal data.
NIS2 has applied since December 2025: inventory ERP-to-shop interfaces, encrypt them end-to-end via TLS and secure them with OAuth 2.0, OpenID Connect and mTLS.
Many ERP-to-shop APIs still run on static keys. How the client credentials flow, mTLS, DPoP, short token lifetimes and scope minimization harden the API.