> ## Documentation Index
> Fetch the complete documentation index at: https://docs.smokeball.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Learn how to follow best security practices

This guide covers essential security practices for handling authentication tokens and securing your app on the Smokeball platform.

## Best Practices

Here are essential security practices for handling OAuth 2.0 authentication tokens in your application:

### Secure Token Storage

* Never store access tokens or refresh tokens in client-side code, local storage, or cookies
* Store tokens securely on your backend server using:
  * Encrypted databases
  * Key management services (AWS KMS, Azure Key Vault, etc.)
* Use environment variables for sensitive credentials in development
* Implement proper access controls and audit logging for token access

### Token Handling

* Only transmit tokens over HTTPS/TLS
* Implement token refresh using the supplied refresh token
* Revoke compromised tokens immediately or contact us if you think you have been compromised

### API Key Rotation

Rotate your API key regularly and immediately if you suspect it has been exposed. This helps reduce the risk of unauthorized access and limits the impact of compromised credentials.

To rotate your API key, sign in to the Developer Console and navigate to the API section. Find the option to rotate your API key and follow the prompts:

<Frame>
  <img src="https://mintcdn.com/smokeball/RUALEgvXmXPrqwbI/images/apps/api-key-rotation.png?fit=max&auto=format&n=RUALEgvXmXPrqwbI&q=85&s=06b50d5f5cd792b731e1635a858aa507" alt="API key rotation screenshot placeholder" width="845" height="397" data-path="images/apps/api-key-rotation.png" />
</Frame>

## Resources

* [OAuth 2.0 Best Practices](https://oauth.net/2/)
* [OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc6819)