Have permission to contact recipients and issue wallet passes.
Keep API keys, webhook secrets, and provider credentials confidential.
Review provider status, approvals, activity history, and suppression lists.
Do not use PassTools for unlawful, abusive, or deceptive content.