Security

Keep the deployment URL trusted

The bearer token is organization-scoped. Treat the base URL as security-sensitive. The request() method accepts relative paths and rejects Authorization overrides to prevent credential forwarding to other hosts.

Use HTTPS outside local development

Require TLS for production and staging. Restrict plain HTTP to local development environments.

Scope credentials by workload

Assign separate credentials per workload to limit access. A reporting job requires read scopes, while a deployment script requires write scopes.

Do not log bodies by default

Ticket and document bodies can contain operational details or private data. The SDK logger records metadata only.

HTML is server-owned security logic

The API accepts HTML fields. Okatana handles sanitization and mention authorization. Process returned HTML according to the consuming application's security model.

Credential rotation

Supply tokens via environment variables or secret managers to allow rotation without code deployments.

Multi-tenant integrations

Do not infer organization access from object IDs. The credential determines organization boundaries. A 403 on a cross-organization resource is a security failure, not a transient error.