Skip to Content
v1.5Official documentation for the LX CloudPos API · stable in production
v1.5 (current)Authentication and securityConnection security

Connection security

All communication with https://api.pos.lxsyscr.com is encrypted and validated in transit. These are the guarantees and obligations of the channel:

  • TLS 1.2+ required. Earlier versions are rejected.
  • HTTPS only — redirects from http:// to https:// are disabled; 400 Bad Request is returned directly to avoid leaking the API key on the first hop.
  • Valid certificate — issued by a verifiable public CA.
  • HSTS active with max-age=31536000; includeSubDomains; preload.

For integrators

  • Always use the literal URL https://api.pos.lxsyscr.com; don’t build it dynamically.
  • Verify the TLS certificate on the HTTP client. Most clients do this by default — it must not be disabled “for testing.”
  • Don’t publish the API key in frontend builds; keep it on the backend side at all times.
Key rotationTenant isolation