Credential separation
Applications use an account API key and a mailbox API key. Mailbox passwords and OAuth tokens are never intended for public client-side code.
SECURITY & CONTROL
MailBridgeAPI-Sicherheitszentrum
Understand how MailBridgeAPI separates mailbox credentials, API access, account protection and public documentation.
Encryption in transit
Production website, dashboard and API traffic uses HTTPS. Provider connections use the encryption modes selected for the mailbox configuration.
OAuth token protection
Gmail, Microsoft, Yahoo and Zoho access and refresh tokens are encrypted at rest with AES-256-GCM using private server-side encryption keys.
WordPress protection
The official plugin never stores the dashboard password or mailbox password. Selected API credentials are encrypted locally with a key derived from WordPress authentication salts.
Account controls
The dashboard supports login history, two-factor authentication and recovery codes. Sessions and access can be revoked.
Data minimisation
Only the data required to provide the requested email, activity, support, monitoring or billing operation should be submitted.