APEX SDK Authentication

Or a better question is do you have documentation on how authentication works for the APEX SDK? 

Hi Peter,

For your questions:

• What is the life time of an API key?
• Is the API key generated only for the APEX SDK use, i.e. not shared by any other application?

API Key won't expire in OneSpan Sign, and unfortunately it can be used to authenticate any integration other than APEX SDK. A more secured mechanism is to use API Token instead of API Key so that you can rotate the client ID and Secret on schedule. But APEX SDK doesn't support API Token by default (it's a new feature introduced after the latest SDK update), you may have to adjust the source code a little bit and retrieve an access token via this call:

POST /apitoken/clientApp/accessToken

{ "clientId": " your_client_id ", "secret": " your_client_secret ", "type": "SENDER", "email": "sender_email" }

• Is this a one-way or mutual TLS between OneSpan and Salesforce?

Without further configuration, I believe it's an one-way SSL that your APEX callout can only reach sites configured in remote site settings.

Duo