Okta Partners

Quality & tooling

Security

Embedded

  • ✓ Policy scanner (regex + PHPStan AST) on every PR.
  • ✓ Postgres role/schema isolated from the platform.
  • ✓ BlocksPartnerDirectAccess trait refuses access outside App\Services\PartnerApi\*.
  • ✓ Every scope checked at runtime via AppPermissionGuard.

External

  • ✓ Installation token encrypted at rest.
  • ✓ Webhooks signed + timestamped + replay-protected.
  • ✓ HTTPS-only webhook_url.
  • ✓ Okta-side rate limit (60 req/min per installation).

Your responsibilities

  • Never log the installation token.
  • Store webhook_secret in a secret manager.
  • Apply your own rate limits if forwarding tenant data.
  • Don't store tenant data beyond what you need.

View the whole guide on one page · ↧ Raw Markdown