Security checklist

Backend

• Keep sk_test_ and sk_live_ keys in a server secret manager.
• Authenticate and authorize every partner-owned endpoint.
• Load Smore IDs from your authorized records; never treat a caller-supplied Smore ID as authorization.
• Use explicit outbound timeouts and preserve Smore’s safe status, body, Retry-After, and requestId.
• Return Smore resources and embed URLs with Cache-Control: private, no-store.
• Keep raw credentials, prompts, media, signed URLs, and complete embed URLs out of logs and analytics.

Idempotency

• Persist the exact create or edit body and canonical UUID v4 before submitting.
• Replay the same key only with the same method, path, and body.
• Use a new key only for an explicit new operation.
• Never place user identifiers or personal data in an idempotency key.

Iframe

• Accept messages only from https://embed.smore.video and the mounted iframe’s contentWindow.
• Send refresh commands using that exact target origin.
• Include allow="gamepad; hid; fullscreen" and the documented sandbox permissions.
• Treat the complete embed URL as a short-lived bearer secret.
• Revoke abandoned or canceled sessions.

Reference packages

• Forward package IDs to your backend, never Smore media URLs or keys to the browser.
• Queue the package ID with the expected scene ID loaded from your authorized record.
• Retrieve fresh signed URLs when the durable job starts.
• Verify referencePackage.sceneId before acknowledgment or downstream work.
• Deduplicate notification jobs by scene plus package and downstream work by package ID.

Data handling

• Use internal record IDs rather than emails or personal data.
• Do not attempt to extract or persist Smore scene artifacts, controller samples, or agent traces.
• Confirm retention, subprocessor, key-rotation, and incident-response requirements during onboarding.