Demo environment
IP Access Control
Restrict by IP address
2FA Requirements
When to enforce two-factor authentication
By plan tier:
Password Policy
Set complexity and expiry requirements
Mobile API Auth
Bearer token support for mobile apps
✓ All platform endpoints now support bearer tokens
Send: Authorization: Bearer <token>
Demo tokens: demo-bearer-super (SUPER_ADMIN), demo-bearer-admin (PLATFORM_ADMIN)
Rate Limit Enforcement
Quota enforcement on API requests
✓ Rate limiting now active per merchant
Responses include X-Quota-Remaining & X-Quota-Limit headers
Returns 429 when quota exceeded. Set limits in /admin/quotas