adobe-security-basics

# Adobe Security Basics ## Overview Security best practices for Adobe OAuth Server-to-Server credentials, I/O Events webhook signature verification, and least-privilege access control across Adobe APIs. ## Prerequisites - Adobe Developer Console access - Understanding of OAuth 2.0 client_credentials flow - Access to secret management solution (Vault, AWS Secrets Manager, GCP Secret Manager) ## Instructions ### Step 1: Secure Credential Storage ```bash # .env (NEVER commit to git) ADOBE_CLIENT_ID=abc123def456 ADOBE_CLIENT_SECRET=p8_XYZ_your_secret_here ADOBE_SCOPES=openid,AdobeID,firefly_api # .gitignore — MUST include these .env .env.local .env.*.local *.pem *.key ``` ```bash # Production: use your cloud provider's secret manager # AWS Secrets Manager aws secretsmanager create-secret \ --name adobe/production/credentials \ --secret-string '{"client_id":"...","client_secret":"..."}' # GCP Secret Manager echo -n "your-client-secret" | gcloud secrets create adobe-client-secret --data-file=- # HashiCorp Vault vault kv put secret/adobe/prod client_id="..." client_secret="..." ``` ### Step 2: Credential Rotation Adobe OAuth Server-to-Server credentials support multiple client secrets simultaneously, enabling zero-downtime rotation: ```bash # 1. In Adobe Developer Console, generate a NEW client_secret # (old secret remains valid) # 2. Update your secret manager with the new secret aws secretsmanager update-secret \ --secret-id adobe/production/credentials \ ...