Security
What Ryde requires of an integration, and what it will never ask you for.
- TLS everywhere, with verification ON. Never disable certificate checks to make something work — that turns a broken configuration into a silent interception.
- Store secrets server-side, in a secret manager. Not in Git, not in a build artifact, not in an environment file you commit, not in a prompt.
- Request the fewest scopes that work. Over-asking trains customers to approve without reading.
- Treat access tokens as customer data: never log them, never put them in a URL, never forward them off Ryde.
- Rotate credentials on any suspicion, and on staff changes.
Ryde will never ask you for a customer's password, and you must never collect Ryde credentials in your own interface or imitate the Ryde sign-in screen. Customers sign in on Ryde, on a Ryde-hosted page, every time.
Payments
The Agent Network exposes no raw card handling and never will. Payment happens through the customer's own stored Ryde payment methods and wallet. No endpoint accepts or returns a card number, CVV, PIN or track data — if you find yourself wanting to send one, the integration has gone wrong.