navan-security-basics

# Navan Security Basics ## Overview Navan holds SOC 1 Type II, SOC 2 Type II, ISO 27001, PCI DSS Level 1, GDPR, CSA, and VSA certifications. Infrastructure runs on AWS with TLS encryption in transit and AES encryption at rest via KMS. Annual penetration testing and OWASP compliance are standard. This skill covers the developer's responsibility: securing OAuth 2.0 credentials, configuring SSO through supported identity providers, setting up SCIM for automated user provisioning, and establishing rotation schedules. ## Prerequisites - Navan admin account with API credential management permissions - Access to Admin > Travel admin > Settings > Integrations for OAuth app creation - Identity provider admin access (Okta, Azure AD, or Google Workspace) for SSO/SCIM setup - Node.js 18+ or Python 3.8+ for credential management scripts ## Instructions ### Step 1: Secure OAuth 2.0 Credential Storage ```bash # Create .env file — NEVER commit this cat > .env << 'EOF' NAVAN_CLIENT_ID=your-client-id NAVAN_CLIENT_SECRET=your-client-secret NAVAN_TOKEN_URL=https://api.navan.com/ta-auth/oauth/token EOF # Ensure .env is gitignored echo '.env' >> .gitignore echo '.env.*' >> .gitignore ``` ```typescript // Load credentials from environment only — never hardcode import { config } from 'dotenv'; config(); async function getAccessToken(): Promise<string> { const { NAVAN_CLIENT_ID, NAVAN_CLIENT_SECRET, NAVAN_TOKEN_URL } = process.env; if (!NAVAN_CLIENT_ID || !NAVAN_CLIENT_SECRET) { throw...