Access, cookies, and secrets

Developer accounts

When publishing using your company's accounts, invite SiteCargo as a separate user. Do not share an Apple ID or Google account password, or a two-factor authentication code.

Grant access only to the relevant app and release functions. User management, finance, and tax permissions are usually not required. When the collaboration ends, remove the user or service account directly in App Store Connect and Google Play Console.

Cookies and website authentication

End users should sign in through the connected website's regular authentication system. On a device, check sign-in, sign-out, session persistence, password recovery, and that no other user's session remains after sign-out.

DEFAULT_COOKES is suitable only for shared technical values that are the same for all users. Do not add a session cookie, access token, CSRF token, personal identifier, or administrator credentials.

What must not be included in the app

• passwords and session cookies;
• service account private keys;
• Stripe secrets and webhook secrets;
• API tokens with permission to modify data;
• signing certificates, production keystores, and their passwords.

JavaScript, JSON configuration, demo access, and DEFAULT_COOKES fields are not secure secret storage. Do not send secrets through email, regular chat, or screenshots; use an agreed secure channel.