esimtida API enforces strict security measures by default. This document outlines the mechanisms protecting your endpoints from unauthorized access and abuse.

Rate Limiting

To ensure platform stability, all API requests are subject to rate limits. The standard limit is 60 requests per minute per IP address or authenticated token.

CORS Policies

Cross-Origin Resource Sharing (CORS) is strictly configured. By default, API endpoints accessible via Public Keys (`pk_live_`) accept requests from any origin, while Secret Key endpoints strictly reject browser-based requests to prevent CSRF and token leakage.

Data Validation

All incoming payloads are strictly sanitized using Laravel's FormRequest validators. Unexpected fields are discarded, and SQL injection is mitigated via PDO bindings. XSS protection is built-in for all text inputs.