Skip to main content
Every bearer token must remain confidential: never share it or expose it within client-side code.
To verify incoming requests, the Ruba API supports two distinct methods.
  1. Organization Access Tokens (OAT) - The suggested approach
  2. OAuth 2.0 Provider (for partner integrations)

​
Organization Access Tokens (OAT)

These tokens are bound to one of your organizations, and you generate them from within your organization settings.

​
Safeguarding Your Tokens

To defend your data and keep Ruba secure, we deploy several mechanisms that automatically invalidate tokens discovered to be exposed publicly on the internet. Among them, we participate in the GitHub Secret Scanning Program. Whenever GitHub detects a Ruba token inside a code repository or public discussion, our systems receive a notice and the affected tokens are revoked right away. Should you receive an email indicating that one of your tokens leaked, it means we were alerted to that situation. The message outlines what kind of token was involved and where the leak originated. Going forward, it is essential to remain vigilant and avoid exposing your tokens publicly online. You can learn more about good practices for handling secrets in the OWASP Secrets Management Cheat Sheet.