1 min lesson
Auth patterns and secret handling
Work through this case. "Your workflow only creates CRM contacts. The vendor offers a full-access API key and a scoped key limited to creating contacts. Where does the credential go?" Say what you would do and why.
Step 1 of 2
Auth patterns and secret handlingAPI keys, OAuth, scoped tokens
The auth you will meet
- API key
- A static secret in a header. Simple, but rotate it and never commit it.
- OAuth
- The user grants access and you get a token. Use it for acting on a user's behalf, such as reading their Gmail.
- Scoped token
- A token limited to specific permissions: least privilege, smaller blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. if leaked.
Always prefer the narrowest scope; store secrets in a vault, never in code or Clay cells.
Watch out
Pasting a full-access API key into a Clay column or a Zap is the kind of shortcut that surfaces in a security review. Use scoped keys, keep secrets in a manager and be ready to say how you would rotate one. A shortcut that leaks a credential is a fast way to lose the panel.