Skip to main content
Every bearer token must remain confidential: never share it or expose it within client-side code.
To verify incoming requests, the Ruba API supports two distinct methods.
  1. Organization Access Tokens (OAT) - The suggested approach
  2. OAuth 2.0 Provider (for partner integrations)

​
Organization Access Tokens (OAT)

These tokens are bound to one of your organizations, and you generate them from within your organization settings.

​
Safeguarding Your Tokens

Treat every exposed token as compromised. Revoke it immediately from your organization settings, create a replacement, and update every service that used it. Do not wait for a repository host or another scanning service to notify you. Keep tokens out of source code, browser bundles, logs, screenshots, support messages, and committed environment files. You can learn more about good practices for handling secrets in the OWASP Secrets Management Cheat Sheet.