Agent WranglersAPI security
Authenticate every call with scoped tokens, authorise every object, and keep secrets out of addresses. Link to the security playbook for the attacks.
- Required 5
Required
Authenticate with tokens in headers
RequiredAuthenticate API calls with short-lived tokens in the
Authorizationheader, issued through OAuth 2 for anything acting for a user.Grant narrow scopes
RequiredGive each token only the scopes its job needs, and check the scope on every endpoint.
Authorise every object
RequiredCheck on every request that the caller may access the exact object, not just the endpoint.
Keep secrets out of addresses
RequiredNever put tokens, keys or personal data in paths or query strings. Send them in headers or the body.
List every API you run
RequiredKeep a list of every API, version and host you expose, and switch off what is no longer used.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security.