TABLE OF CONTENTS

• Purpose
• Introduction
• 1. Use different tokens for different APIs
• 2. Periodically renew the tokens
  • Use two different Tokens for different APIs
  • Renew Tokens
  • How to Renew Tokens
• 3. Upgrade Instructions for a user of the old security version
  • The major change
  • How to upgrade
  • The upgrade page before&after
• FAQ:

Purpose

1. The document is here for reference only and as an example of how DerbySoft is aware and staying on top of such things in the industry.
2. Describes what Access Token is and how to renew it on GO Console

Introduction

We use various technologies and processes to secure the information stored on the DerbySoft servers. Data encryption, access limitation to system components and customer credit data, necessary tracking, and monitoring are used to ensure security. Based on AWS services, DerbySoft builds an isolated data environment that fully complies with PCI (Payment Card Industry) security compliance requirements, which can effectively reduce the risk of data theft, identity fraud, and unauthorized transactions.

To ensure secure data transfer and access, GO Distributors requires the following security measures for the connectivity service:

1. Use different tokens for different APIs

You can refer to the below table based on your API type:

2. Periodically renew the tokens

Use two different Tokens for different APIs

Renew Tokens

Important:
Each token has a 180 days period of validity. The expiry date can be found on GO Console Env Setting Page. DerbySoft will send the notifications before expiration.

Distributors need to renew and apply the tokens before the expiration date.

Once a new token has been generated by the Distributor in GO Console, the previous one will still be acceptable for another 7 days, you will have sufficient time to test your system. (If it is less than 7 days before the expiry date, the previous token will expire at the original expiry time.)

Here are the V4&V3 views for your reference:

• V4 View(GO Console v2)

• V4 View(GO Console v1)

• V3 View:

How to Renew Tokens

Users with permission can renew the tokens on the Setting - Env Setting Page, please contact go.help@derbysoft.net for permission application if needed.

Token Renewing process chart

3. Upgrade Instructions for a user of the old security version

We have introduced an advanced security policy to better support the security of data transfer and access for the connectivity service.

The major change

Two different tokens are to be used while requesting GO APIs. Each token is valid for 180 days.

How to upgrade

Step 1: Make necessary changes in your system to support two different tokens.

Step 2 Click the upgrade button on the Env Setting Page.

Step 3 Go through the upgrade process.

The upgrade page before&after

• Token Setting Page Before Upgrade

• Token Setting Page After Upgrade

We highly recommend that you renew the BookingUSB Token & ShoppingEngine/AvailabilityPeer Token and apply them to your system right after the upgrade.

Notes:
① Your previous AccessToken is still valid before the expiry date after upgrading. You can check the expiry date on GO Console.

② Once a new Token has been generated, the previous one will still be acceptable for another 7 days, you will have sufficient time to test your system. (If it is less than 7 days before the expiry date, the previous token will expire at the original expiry time.)

FAQ:

Q: We are currently using GO v4 Push API. The Access Token in the request header is used to authenticate both Derbysoft endpoints and our endpoints. We would like to better understand how Derbysoft authenticates our requests and how we authenticate Derbysoft requests.

A: You may have observed that there are two Access tokens and two endpoints associated.

When you make a call to our BookingUSB API, please ensure that you pass the Access Token of BookingUSB in the request header. This Access Token will be verified by us upon receipt of your request.

Similarly, if we call your AvailabilityPeer API, we will pass the Access Token of AvailabilityPeer in the request header. It will then be up to your system to verify this Access Token.