What this guide covers

Keep API and integration secrets out of unsafe channels.

Store secrets in approved password or secret-management tools. Use separate credentials per environment and grant only required permissions. Rotate exposed credentials immediately, update the affected integration, and review logs for unexpected activity.

Before you begin

  • Sign in to AyuChat and confirm the correct workspace is selected.
  • Use a role with access to Security and privacy.
  • Keep real customer data, API keys, payment details, Meta tokens, OTPs, and passwords out of screenshots and support messages.

Where to find it in AyuChat

Open the customer SaaS app and navigate to the Security and privacy area at /admin/workspace-settings. If the page is unavailable, review your role permissions, active workspace, and plan access.

  1. Start with a small controlled test in the active workspace.
  2. Review the visible status, validation messages, and saved data before using the feature for real customers.
  3. Check related logs, analytics, or delivery state when the action depends on WhatsApp, automation, integrations, billing, or webhooks.
  4. Document any non-secret identifiers needed for support, such as record id, invoice number, campaign name, or timestamp.

Verify the result

  • The expected record, status, or configuration appears after refresh.
  • No page shows a blank screen, auth loop, CORS error, or unexpected server error.
  • The result belongs to the selected workspace only.
  • Any customer-facing message uses approved templates and consented contacts where required.

Common problems

ProblemWhat to check
Feature is missing or disabledConfirm role permission, plan entitlement, and active workspace.
Data looks incompleteRefresh the page and verify the workspace switcher before assuming records are missing.
Action fails validationReview required fields, connected WhatsApp state, template approval, file type, or billing state depending on the feature.
External provider behavior differsCheck the current provider dashboard or official provider documentation for policy, billing, or review-state changes.