# `Daraja.HTTPClient.Compliance`
[🔗](https://github.com/okothkongo/daraja/blob/v0.1.1/lib/daraja/http_client/compliance.ex#L1)

Security checklist for custom `Daraja.HTTPClient` implementations.

The behaviour defines only the `request/4` callback shape. When you provide
your own adapter, ensure it meets these minimum requirements before using it
with live M-PESA credentials:

  * **TLS** — Verify server certificates against a trusted CA store (or your
    pinned trust store). Never disable peer verification in production.
  * **Credential safety** — Do not log request or response bodies, headers
    such as `Authorization`, or STK `Password` fields.
  * **Timeouts** — Use bounded connect and receive timeouts so hung requests
    cannot accumulate indefinitely.
  * **Redirects** — Do not follow redirects to hosts outside Safaricom's
    documented API domains (`sandbox.safaricom.co.ke`, `api.safaricom.co.ke`).

Use `checklist/0` in onboarding docs or CI smoke tests for custom clients.

# `checklist`

```elixir
@spec checklist() :: [String.t()]
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*