1 min lesson
Auth patterns and secret handling
Use "Auth patterns and secret handling" to explain each part and the role it plays.
Step 1 of 2
Auth patterns and secret handlingAPI keys, OAuth, scoped tokens
The auth you will meet
- API key
- a static secret in a header; simple, but rotate it and never commit it
- OAuth
- user grants access, you get a token; for acting on a user’s behalf (e.g., their Gmail)
- Scoped token
- a token limited to specific permissions - least privilege, smaller blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. if leaked
Always prefer the narrowest scope; store secrets in a vault, never in code or Clay cells.
Watch out
Pasting a full-access API key into a Clay column or a Zap is the kind of shortcut that surfaces in a security review. Use scoped keys, keep secrets in a manager and be ready to say how you would rotate one. Convenience that leaks credentials is not senior.