Aegis Developer PortalDeveloper Search
Press ⌘K or Ctrl+K to jump through guides and API endpoint docs.
Security Controls
Self-Serve Security Controls
Operational baseline for secure integrations: short-lived tokens, request proof, rotation, and incident response.
Token Policy
Least Access
Request only the permissions needed for each integration flow.
Proof Binding
Sender-Constrained Requests
Require request-level proof for sensitive operations and enforce replay checks.
Containment
Fast Revocation
Keep explicit revoke paths for compromised tokens, keys, and affected callers.
Token Lifecycle Controls
- Use short token TTLs.
- Keep tokens in memory where possible.
- Require nonce/jti replay protection.
- Rotate keys on a fixed schedule.
- Trigger emergency revocation on suspicious activity.
Key Rotation Runbook
1. Register new signing key.
2. Roll callers to the new key.
3. Confirm traffic shift.
4. Revoke old key.
5. Monitor for residual old-key traffic.Use a dual-key window for cutover, then retire old keys immediately after traffic confirmation.