miro-security-basics

# Miro Security Basics ## Overview Security best practices for Miro OAuth 2.0 tokens, webhook signatures, and access control across the REST API v2. ## Prerequisites - Miro app created at https://developers.miro.com - Understanding of OAuth 2.0 concepts - Secret management solution for production ## OAuth Token Security ### Never Store Tokens in Code ```bash # .env (NEVER commit to git) MIRO_CLIENT_ID=3458764500000001 MIRO_CLIENT_SECRET=your_client_secret_here MIRO_ACCESS_TOKEN=eyJ... MIRO_REFRESH_TOKEN=eyJ... # .gitignore — MUST include these .env .env.local .env.*.local *.pem ``` ### Scope Minimization Request only the scopes your app actually needs. Fewer scopes = smaller blast radius if a token is compromised. | Use Case | Minimum Scopes | |----------|---------------| | Read-only dashboard | `boards:read` | | Board automation | `boards:read`, `boards:write` | | Team management | `boards:read`, `team:read`, `team:write` | | Enterprise admin | `boards:read`, `organizations:read`, `auditlogs:read` | | Full integration | `boards:read`, `boards:write`, `identity:read` | ### Token Lifecycle Management ```typescript // src/miro/token-manager.ts interface TokenInfo { accessToken: string; refreshToken: string; expiresAt: number; // Unix timestamp in ms scopes: string[]; } class MiroTokenManager { constructor( private storage: TokenStorage, // DB, Redis, or Vault private clientId: string, private clientSecret: string, ) {} async getValid...