Workato docs Return to Workato
Edit this page
GitHub (opens new window)
  • Introduction
  • Getting started
  • Product Updates (opens new window)
  • Concepts
  • Connecting apps
  • Building recipes

  • Running recipes

  • Troubleshooting

  • Data types and formulas

  • Tools
  • Files and attachments

  • Batch processing

  • Teams and collaboration
  • People Task by Workato
  • Recipe lifecycle management
  • On-prem connectivity
  • Key features
  • Workbot for Slack
  • Workbot for MS Teams
  • Workbot for Workplace
  • API Platform
  • Connectors

  • Universal connectors
  • Community connectors
  • Connector SDK
  • Custom OAuth profiles
  • Workato API
  • Security
  • Training & Certification
  • Contact us

# Security Best Practices for APIs

Workato Callable recipes as APIs are a powerful feature that allows access to Workato functionality from other recipes as well as from sources external to Workato. But, since recipes can perform operations on your business systems, it is important to avoid unauthorized access to them through APIs.

Here are some recommendations for maintaining security when using APIs:

  1. Treat API tokens like a password. They are confidential information that can grant access to your API to anyone who possesses them. As a best practice, don't distribute them to clients through insecure channels such as email. Use a secure messaging system or a document system such as Dropbox to which both the API owner and the intended client have access.

  2. Don't distribute the same API token to multiple people. An API token identifies a client and enables monitoring requests in the API dashboard on a per-client basis. If multiple people have the same API token, there is no ready way to determine who is making calls to your API.

  3. Consider having a policy to periodically refresh API tokens. This is similar to expiring a password and ensures that any compromise of an API token does not provide very long-term access to systems. Alternatively, distribute a JWT token with an expiration time set ("exp" claim). This will give the token a limited lifetime.

  4. Use IP whitelisting (part of the Access Profile for a client) to restrict the originating IPs that are allowed to have API access. A whitelist is a best practice from a security perspective. However, some clients may not have a fixed IP address (for example, clients connected from a home network may get varied IPs from their providers), or may connect from multiple IP addresses (for example, while traveling). In this case, it may not be readily possible to whitelist their IPs.

  5. Consider distributing a JWT token encapsulating the Auth Token secret instead of the secret itself. JWT tokens are signed, include the client identity and can have an expiration. Learn how to set up a JWT token.

  6. If a person should no longer have access to APIs (e.g. because they are leaving employment), ensure that a person's client profile is disabled or deleted in Workato.

← Setting up endpoints to handle raw content Overview →

Didn’t find what you are looking for?
Search our resource library View getting started guides, tutorials, training videos, webinars and FAQ Ask our community View questions and answers from other users and Workato experts. File a support ticket File a support ticket for critical issues that require a higher level of support.
Privacy Terms (844) 469-6752 Workato 2021