Short answer: Good eSIM reseller account security comes down to five habits: give every person their own login with the right role, keep two-factor sign-in on, give each API key only the scopes it needs and lock it to your server IPs, verify every webhook signature, and put sensible limits around your prepaid balance. The eSIM Signal partner programme has a built-in control for each of these, so a small team can set them up in an afternoon.
A wholesale eSIM account is not just a dashboard. It holds a prepaid balance, it can create live eSIMs in seconds, and its API keys can do the same from any script that holds them. Treat it like the keys to your stock room.
Why account security matters for an eSIM reseller
The risks are practical rather than theoretical:
- A leaked API key in a public repository or a shared document can be used to place orders against your balance.
- A shared login means you cannot tell who did what, and you cannot remove one person without changing the password for everyone.
- An unverified webhook endpoint can be fed fake "order completed" events, confusing your shop or your customer emails.
- A departing employee who still has access can see customer references and order history.
None of these needs complex tooling to prevent. It needs the platform's controls switched on and a short routine.
Step 1: Give every person their own login and role
The Business Panel supports team members with admin or user roles. Use them instead of one shared account.
- Admin role: for the owner and the one or two people who manage the account, billing and team.
- User role: for day-to-day staff who place orders, look up eSIMs and answer customer questions.
Rules that keep this clean:
- One person, one login. Never share a sign-in between colleagues or with an agency.
- Keep admins few. Two admins is usually right: one is a single point of failure, five is hard to control.
- Review the list monthly. Remove anyone who has left or changed role on the day it happens.
- Use work email addresses, so access ends when the mailbox is closed.
Tip: write down who your admins are and how to reach them. When something urgent happens on a Friday evening, you do not want to be searching for who can change a setting.
Step 2: Keep two-factor sign-in switched on
The panel offers email two-factor sign-in, which sends a code to the user's inbox at login. It protects you against the most common attack of all: a password reused from another site that has been breached.
- Turn it on for every team member, not just admins.
- Make sure each person's mailbox is itself protected with a strong password and two-factor authentication, because the code is only as safe as the inbox.
- Do not forward sign-in codes to shared mailboxes.
Step 3: Scope and lock down your API keys
If you sell through your own website or app, your API keys are the most valuable credential you have. The eSIM Signal REST API at https://esimsignal.com/api/v1 uses Bearer API keys with scopes, an IP allow-list and read-only test keys.
Give each key only the scopes it needs
Scopes cover catalogue, orders, esims and refunds. Create separate keys for separate jobs:
- A catalogue-only key for a price-sync job that refreshes your shop's plans.
- An orders and esims key for the checkout service that creates and looks up eSIMs.
- A refunds scope only on the key used by the staff tool that handles refunds, if you automate them at all.
If a catalogue key leaks, nobody can place orders with it.
Lock production keys to your server IPs
Add your servers' IP addresses to the IP allow-list, so a stolen key is useless from anywhere else. Remember to update the list before you move hosting or add a new server, or your orders will be refused.
Use test keys while building
Read-only test keys let developers and agencies work on your integration without touching live orders or your balance. Only give a contractor a live key when they truly need it, and replace it when the work ends.
Store and rotate keys properly
- Keep keys in environment variables or a secrets manager, never in code, spreadsheets or chat messages.
- Replace a key straight away if it might have been exposed, and whenever someone with access leaves.
- Keep a short list of which key is used by which system, so a replacement does not break anything.
Our eSIM reseller API integration guide shows where each key fits in a typical integration.
Step 4: Make orders safe to retry
Security also means not creating orders you did not intend. Send an Idempotency-Key with every order request so a network timeout followed by a retry cannot create a second eSIM. Add a customer_ref with your own order or customer id, which makes every eSIM traceable to a sale when you check your records later.
Step 5: Verify every webhook
Webhooks such as order.completed, order.failed, order.refunded, esim.activated and esim.expired are signed with HMAC-SHA256 in the X-ESIMSIGNAL-Signature header. Your endpoint should:
- Compute the HMAC-SHA256 signature with your webhook secret exactly as the API docs describe, using the raw request body rather than re-encoded JSON.
- Compare it with the header and reject the request if it does not match.
- Treat events as idempotent, so a repeated delivery does not send a customer two emails.
- Keep the webhook secret as carefully as an API key.
Step 6: Put guard rails around billing
Your account runs on a prepaid balance topped up by card, which already limits your exposure: nothing can be ordered beyond what is in the balance. Make the most of that:
- Low-balance alerts: make sure they reach someone who can act on them quickly, so a busy weekend does not stop sales.
- Automatic top-up: useful for steady sellers, but decide who owns the saved card and review it when roles change.
- Saved card: keep it a company card held by an admin, not a personal card of a staff member.
- Weekly ledger check: the itemised ledger with receipts and CSV/Excel exports makes it easy to spot orders that do not match your sales.
Refunds follow the platform rule: an eSIM that was never installed can be refunded to your balance within the refund window; installed or used eSIMs cannot. Decide who on your team may issue refunds and keep that to a small group. Our customer support playbook for eSIM resellers covers how to handle refund requests from customers.
Step 7: Offboarding checklist when someone leaves
- Remove their team member login the same day.
- Replace any API keys they could see, and update the IP allow-list if they managed a server.
- Check that the saved card and alert emails do not belong to them.
- Confirm webhook secrets and support inbox access have moved to someone else.
- Look over recent ledger entries for anything unexpected.
Getting help
Every partner has a named account manager by email or WhatsApp, usually replying within one business day, and support tickets with screenshots inside the panel. If you think a key or login has been exposed, raise it straight away after you have replaced the key.
New to the platform? Read how the eSIM Signal partner programme works, then apply for a partner account or get wholesale rates.
Frequently asked questions
Can I add my staff to my eSIM reseller account?
Yes. The Business Panel supports team members with admin or user roles, so each person has their own login instead of sharing one.
What should I do if my eSIM API key is leaked?
Replace the key straight away, check your ledger for orders you do not recognise and contact your account manager. An IP allow-list on production keys stops a leaked key from being used outside your servers.
How do I verify an eSIM webhook is genuine?
Compute the HMAC-SHA256 signature with your webhook secret, as shown in the API docs, and compare it with the X-ESIMSIGNAL-Signature header. Reject any request where they do not match.
Is two-factor authentication available for the partner panel?
Yes. Email two-factor sign-in sends a code to the user's inbox at login, and it is worth switching on for every team member.
Can someone run up a bill on my account?
Orders are paid from your prepaid balance, so nothing can be ordered beyond what is in it. Scoped keys, IP allow-lists and careful control of automatic top-up limit the risk further.