Security

This guide covers essential security practices for handling authentication tokens and securing your app on the Smokeball platform.

​

Best Practices

Here are essential security practices for handling OAuth 2.0 authentication tokens in your application:

​

Secure Token Storage

• Never store access tokens or refresh tokens in client-side code, local storage, or cookies
• Store tokens securely on your backend server using:
  • Encrypted databases
  • Key management services (AWS KMS, Azure Key Vault, etc.)
• Use environment variables for sensitive credentials in development
• Implement proper access controls and audit logging for token access

​

Token Handling

• Only transmit tokens over HTTPS/TLS
• Implement token refresh using the supplied refresh token
• Revoke compromised tokens immediately or contact us if you think you have been compromised

​

Resources

• OAuth 2.0 Best Practices
• OAuth 2.0 Security