Enforce HTTPS/TLS Everywhere
All API traffic must be routed exclusively through HTTPS using a minimum of TLS 1.2, though upgrading to TLS 1.3 should be your standard. You must never allow plaintext HTTP, insecure fallback protocols, or weak cipher suites to exist anywhere within your architecture. Transmitting sensitive headers over insecure connections is a fatal mistake that will immediately expose your authorization tokens, session cookies, wallet signatures, and user credentials to anyone sniffing the network.

Use Mutual TLS (mTLS) for Critical Infrastructure
For high-risk internal systems like settlement engines, custody systems, banking integrations, treasury APIs, and institutional transaction flows, standard encryption isn't enough. You must implement mutual TLS (mTLS) authentication. By forcing both the client and the server to cryptographically authenticate each other before any data is exchanged, mTLS ensures that even if a bad actor manages to intercept a valid token, they cannot interact with your critical infrastructure without also possessing the correct, securely verified client certificate.

Enforce IP Whitelisting
Even if a production API key leaks, an attacker should still hit a brick wall. You must restrict your API access exclusively to explicitly approved server IPs, secure VPN gateways, or your private infrastructure networks. High-stakes, critical operations, like withdrawals, settlement execution, wallet creation, and administrative actions must be hardcoded to execute only when the request originates from these verified, trusted origins. If the IP doesn't match the whitelist, the request should die instantly, regardless of whether the attacker is holding a valid key. On Quidax, here’s a guide on how to whitelist your IP address.

Segment Production Infrastructure
You should never place your production databases, hot wallet infrastructure, admin systems, and staging environments inside the same unrestricted network zone. To protect your core assets, enforce strict network segmentation, VPC isolation, firewalls, and restricted service communication. By isolating these environments, you ensure that even if a single peripheral service becomes compromised, attackers cannot exploit that foothold to gain lateral movement across the rest of your critical infrastructure.