Ramp Integration Security Baseline

Overview

Protect credentials and financial authority as separate assets. Minimize scopes and data paths, verify webhook authenticity from raw bytes, and require idempotent, approved, reconciled writes.

Prerequisites

• Identify the Ramp application, environment, business entities, affected data and workflows, accountable owner, and rollback boundary.
• Read references/official-docs.md and re-check endpoint schemas, scopes, limits, and support status before a live operation.
• Use synthetic fixtures or Ramp sandbox until production access and business effects are explicitly approved.
• Prepare approved secret storage and a sanitized evidence location.

Current Contract

• Ramp access tokens are opaque bearer credentials bound to environment and scope; they must not be logged or exposed to browser code.
• Webhook subscriptions return a secret and deliveries include X-Ramp-Signature, an HMAC-SHA256 signature over the exact raw request body.
• Embedded Cards can keep PAN/CVV outside application servers; Vault brings card data into the backend and requires production approval.
• Authorization Code flows require strong state verification and exact redirect URIs; Client Credentials is for internal server-side integrations.