Security best practices

The client secret and every access token are credentials. Anyone who holds the secret can request tokens for the market.

Store the secret

• Keep the client secret in a secrets manager or an encrypted environment variable store. Load it at runtime.
• Never put the secret or a token in client-side code, a mobile app, a browser, or a repository. Request tokens only from a server you control.
• Never paste credentials into tickets, chat, or email. Flavours shows the secret once so that you can store it directly.

Limit what each integration can do

• Create one integration per system. Each can then be rotated or revoked without affecting the others, and Last used in the web app shows which system is active.
• Grant the least privilege: select only the scopes the system needs. Removing a scope revokes issued tokens, so you can narrow an integration at any time.

Handle tokens

• Never log a token or a secret. Log the client ID and the HTTP status instead.
• Send requests over HTTPS only. Do not disable certificate verification.
• Keep the token in memory and reuse it for its lifetime. See Token lifecycle.
• On a 401, request a new token once and retry once. Do not loop.
• Respect 429 and Retry-After on the token endpoint.

Rotate and revoke

• Rotate the secret when you suspect it was exposed, and when a person who could read it leaves your team or the vendor that runs the system. Rotation revokes every issued token immediately.
• Revoke the integration when the system is retired.
• Rotate and revoke from the Flavours web app. Both are available to business owners and managers only.