Authentication and API Security

API authentication and security protect Helpdesk data when external systems connect programmatically.

Protect credentials

API credentials, tokens, passwords, and signing secrets must be stored securely.

Never place secrets in:

• public repositories
• browser JavaScript
• public documentation
• tickets
• screenshots
• logs that unauthorized users can read

Use least privilege

An integration should receive only the permissions necessary for its intended function.

Tenant boundary

API requests must resolve and enforce the correct tenant context where tenant-specific data is involved.

Transport security

Use HTTPS for API communication.

Rotation

Rotate credentials when compromise is suspected or according to organizational policy.

Logging

Avoid logging sensitive authentication material.

Good practices

Review active integrations periodically. Remove unused credentials and verify that each integration still has a valid business owner and purpose.