Token Securitylink

Protecting your API tokens is critical for maintaining the security of your Infraspeak integration. This guide covers best practices for token storage, handling, and monitoring.

Security Principleslink

1. Never Expose Tokens in Client-Side Codelink

Tokens should only be used in server-side applications. Never include tokens in:

• JavaScript running in browsers
• Mobile app source code
• Public repositories
• Client-side configuration files

2. Use Environment Variableslink

Store tokens in environment variables, not in source code:

# Set environment variable
export INFRASPEAK_TOKEN="your_token_here"

# Read from environment
import os
token = os.environ.get("INFRASPEAK_TOKEN")
if not token:
    raise ValueError("INFRASPEAK_TOKEN environment variable is required")

3. Never Commit Tokens to Version Controllink

Add token files to .gitignore:

# .gitignore
.env
.env.local
.env.*.local
*.key
secrets.json

If you accidentally commit a token:

1. Immediately revoke the token in Infraspeak
2. Generate a new token
3. Remove the token from git history using git filter-branch or BFG

Incident Responselink

If you suspect a token has been compromised:

Immediate Actionslink

1. Revoke the token immediately in Infraspeak
2. Generate a new token and update your application
3. Review API logs for unauthorized access
4. Document the incident for security review

Post-Incidentlink

1. Identify how the token was exposed
2. Implement controls to prevent recurrence
3. Review other tokens that may be at risk
4. Update security procedures as needed