> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/verify/web-sdk/recommendations.md).

# Recommendations

## Secure Storage and API Call Recommendations

**Server-Side Storage:**

* Store the `client_id` and `client_secret` securely on your server.
* **Do not expose** these credentials on the client-side.

**Server-to-Server Communication:**

* The API call to obtain the bearer token must be made **from your server** to Vida's server, ensuring secure communication.

**Signing Key:**

* Vida will provide a **signing key** along with the `client_id` and `client_secret`.
* Store the signing key securely on your server.

***

When initialising the Vida SDK:

1. **Obtain the Bearer Token**
   * Use the provided credentials to obtain a bearer token securely from your server.
2. **Retrieve the Signing Key**
   * Retrieve the signing key that was securely stored on your server.
3. **Pass Token and Signing Key to SDK**
   * Provide both the bearer token and signing key when initialising the Vida SDK by passing them to the `init` method.