Security

Security Best Practices for Integrating Orange APIs

Published: May 6, 2026

Discover essential security measures when developing clients that integrate with Orange APIs.

TL;DR

The security best practices on Orange Developer are:

ensure proper authorization using OAuth 2.0, store secrets securely, and encrypt all communications with TLS 1.2.
Handle personal data responsibly and protect callback endpoints from CSRF attacks
The platform also offers tools to prevent access and application fraud, such as access controls, quotas, and user consent. Following these best practices helps mitigate security risks and fraud.

How to secure your API integration?

Securing your API integration implies:

Secure Storage of Secrets

Client ID: the client ID is considered public information; therefore, there are no specific storage requirements.
Client Secret: issued by the authorization server, the client secret is used to authenticate your application. It must be stored securely to prevent access by unauthorized parties.
Authorization Code: this is a short-lived, single-use token used to obtain access and refresh tokens. It should not be stored; instead, it should be exchanged immediately upon receipt.
Access and Refresh Tokens: access tokens should be stored securely. Due to their short lifespan, they can be kept temporarily in memory but should not be stored in cookies or other persistent storage.

Secure Communication

All data exchanges between clients and servers must be encrypted, typically via HTTPS. Orange APIs only support HTTPS with TLS 1.2, as earlier versions (TLS 1.0 and 1.1) have been deprecated due to security vulnerabilities. Ensure all communications with resource servers and other services are appropriately encrypted.

Responsible Handling of Personal Data

Adhere to the Orange APIs General Terms and any specific terms related to the APIs in use to ensure proper management of personal data, especially sensitive information provided by users.

Protecting Callback Endpoints from CSRF Attacks

To prevent Cross-Site Request Forgery (CSRF), include a cryptographically secure random value in the state parameter during the authorization request. Verify this value upon receiving the response at the callback endpoint. Refer to section 10.12 of RFC 6749 for detailed guidance. Avoid passing confidential data within the state parameter.

How to prevent fraud on Orange Developer?

Fraud encompasses various issues such as identity theft, unauthorized service use, exceeding authorized scopes or quotas, and data manipulation leading to fraudulent activities. While the Orange Developer platform cannot prevent all inherent service vulnerabilities, it offers several tools to mitigate fraud risks:

Access fraud protection: The platform acts as an intermediary, controlling API access. Access is granted after a verification process, during which additional validation elements may be required. OAuth 2.0 ensures caller authorization and scope restrictions, helping prevent unauthorized access.
Application fraud protection: Beyond access control, fraud may originate from application misuse, such as overconsumption or data leaks. Although these are managed by the service’s internal controls, the platform can limit risks by implementing access quotas, restricting the number of API calls within a specific timeframe. Additionally, users can be prompted to accept terms and conditions before subscribing to an API.

Conclusion

Preventing fraud effectively requires tailored tools and measures. The Orange Developer platform supports this effort through various mechanisms at API, application, and subscription levels, contributing to a more secure integration environment.