> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getruba.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Authenticate Server-to-Server Requests
export const RubaSocials = () => {
if (typeof document === "undefined") {
return null;
}
const inject = () => {
const footer = document.getElementById("footer");
if (!footer || document.getElementById("ruba-socials")) {
return false;
}
const isDark = document.querySelector("html.dark") || document.querySelector('html[class*="dark"]');
const lineColor = isDark ? "#383838" : "#e8e8ed";
const iconColor = isDark ? "#8e8e93" : "#86868b";
const markColor = isDark ? "#ffffff" : "#08080c";
const hoverColor = "#0071e3";
const div = document.createElement("div");
div.id = "ruba-socials";
div.style.cssText = `display:flex;align-items:center;gap:20px;padding-top:20px;margin-top:20px;border-top:1px solid ${lineColor};width:100%`;
const logo = `Ruba`;
const spacer = ``;
const ig = ``;
const li = ``;
const x = ``;
const github = ``;
div.innerHTML = logo + spacer + ig + li + x + github;
footer.appendChild(div);
return true;
};
if (!document.documentElement.dataset.rubaSocialsObserver) {
document.documentElement.dataset.rubaSocialsObserver = "true";
const observer = new MutationObserver(() => {
if (!document.getElementById("ruba-socials")) {
inject();
}
});
observer.observe(document.body, {
childList: true,
subtree: true
});
}
setTimeout(() => {
if (!inject()) {
const interval = setInterval(() => {
if (inject()) {
clearInterval(interval);
}
}, 500);
setTimeout(() => clearInterval(interval), 10000);
}
}, 300);
return null;
};
Every bearer token must remain confidential: never share it or expose it within client-side code.
To verify incoming requests, the Ruba API supports two distinct methods.
1. [Organization Access Tokens (OAT)](/integrate/oat) - The suggested approach
2. [OAuth 2.0 Provider](/integrate/oauth2/introduction) (for partner integrations)
## Organization Access Tokens (OAT)
These tokens are bound to **one** of your organizations, and you generate them from within your organization settings.
## Safeguarding Your Tokens
To defend your data and keep Ruba secure, we deploy several mechanisms that automatically invalidate tokens discovered to be exposed publicly on the internet.
Among them, we participate in the [GitHub Secret Scanning Program](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning). Whenever GitHub detects a Ruba token inside a code repository or public discussion, our systems receive a notice and the affected tokens are revoked right away.
Should you receive an email indicating that one of your tokens leaked, it means we were alerted to that situation. The message outlines what kind of token was involved and where the leak originated.
Going forward, it is essential to remain vigilant and avoid exposing your tokens publicly online. You can learn more about good practices for handling secrets in the [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html).