attio-security-basics

# Attio Security Basics ## Overview Attio access tokens never expire and have no scopes by default. This makes scoping, rotation, and secret management critical. This skill covers practical security controls for Attio REST API integrations. ## Token Properties | Property | Value | |----------|-------| | Format | `sk_...` prefix | | Expiration | Never (must be manually revoked) | | Default scopes | None (you must explicitly add scopes) | | Scope granularity | Per-resource read vs read-write | | Auth method | `Authorization: Bearer <token>` header | ## Instructions ### Step 1: Apply Least-Privilege Scopes Tokens should have only the scopes needed for their use case: ``` # Read-only analytics integration object_configuration:read record_permission:read # CRM sync (needs write) object_configuration:read record_permission:read-write list_entry:read-write # Webhook receiver (just needs to verify, no API calls) # No scopes needed -- webhook signature uses a separate secret # Full admin (avoid in production) object_configuration:read record_permission:read-write list_entry:read-write note:read-write task:read-write user_management:read webhook:read-write ``` ### Step 2: Environment Variable Management ```bash # .env.local (development -- git-ignored) ATTIO_API_KEY=sk_dev_abc123 # .env.example (committed -- template for team) ATTIO_API_KEY=sk_your_token_here # ATTIO_WEBHOOK_SECRET=whsec_your_secret_here # .gitignore (mandatory) .env .env.local .env.*.local ``` **Platfo...