salesloft-security-basics

# SalesLoft Security Basics ## Overview Secure SalesLoft API integrations: OAuth token management, webhook signature verification, secret storage, and scope-based access control. SalesLoft uses OAuth 2.0 bearer tokens and HMAC-SHA256 webhook signatures. ## Instructions ### Step 1: Secret Storage ```bash # .gitignore -- NEVER commit credentials .env .env.local .env.*.local # .env SALESLOFT_CLIENT_ID=app-client-id SALESLOFT_CLIENT_SECRET=app-secret SALESLOFT_WEBHOOK_SECRET=webhook-signing-secret ``` ```typescript // Validate secrets at startup const required = ['SALESLOFT_CLIENT_ID', 'SALESLOFT_CLIENT_SECRET']; for (const key of required) { if (!process.env[key]) throw new Error(`Missing required env: ${key}`); } ``` ### Step 2: Token Lifecycle Management ```typescript // Store tokens securely with expiry tracking interface TokenStore { accessToken: string; refreshToken: string; expiresAt: number; // Unix timestamp } async function getValidToken(store: TokenStore): Promise<string> { // Refresh 5 minutes before expiry if (Date.now() > (store.expiresAt - 300) * 1000) { const refreshed = await refreshAccessToken(store.refreshToken); store.accessToken = refreshed.access_token; store.refreshToken = refreshed.refresh_token; store.expiresAt = Math.floor(Date.now() / 1000) + refreshed.expires_in; await persistTokenStore(store); // Save to DB or secret manager } return store.accessToken; } ``` ### Step 3: Webhook Signature Verification ```...