أمان بوابة شركاء Okta Okta Partner Portal Security

Security is a top priority at the Okta Partner Portal. We apply industry-grade practices to protect data, API keys, and the module management infrastructure.

• Passwords are stored hashed (bcrypt) — never in plain text.
• Clear roles: Partner Admin, Partner Developer, Partner Viewer — each with scoped permissions.
• Automatic re-authentication on session expiry and prevention of stale sessions.
• CSRF protection on all sensitive POST forms.

• Each API key's secret is shown only once at creation time.
• Secrets are stored as hashes — even our team cannot retrieve them.
• Any key can be revoked instantly from the partner dashboard.
• Scoped permissions per key: read, write, delete, admin.
• Detailed logs for every API call (endpoint, method, status, response time, IP).

• HTTPS/TLS 1.2+ is required for all connections.
• Managed databases with regular, encrypted backups.
• Strict separation between production and development — production data is never used elsewhere.

• No module is published to the main Okta platform without a formal review stage.
• Requested permissions are reviewed and matched against actual usage.
• Full review history (approved, changes requested, rejected) is kept per version.
• Each version has an isolated snapshot — published versions cannot be retroactively edited.

• Integration via a GitHub App with scoped permissions for selected repositories only.
• GitHub webhook signatures are verified before processing.
• Clear confirmation prompt before boilerplate push warns about existing file deletion.
• Integration can be disconnected instantly from partner settings.

• Detailed activity logs for every sensitive action: team invitations, permission changes, key revocations.
• Security alerts on suspicious activity.
• Periodic review of login and API call logs.