Skip to main content
All bearer tokens should be kept private and never shared or exposed in client-side code.
To authenticate requests, Crosspoint API has two mechanisms.
  1. Organization Access Tokens (OAT) - Recommended
  2. OAuth 2.0 Provider (Partner Integrations)

​
Organization Access Tokens (OAT)

They are tied to one of your organization. You can create them from your organization settings, and limit each one to your servers’ IP addresses with an IP allowlist.

​
Security

Limit organization access tokens to your servers’ IP addresses with an IP allowlist: a leaked token is then useless anywhere else. To protect your data, we revoke tokens that are reported to us as leaked publicly on the web. If you received an email about one of your token being leaked, it means that we were notified of such situation. The email contains the details about the nature of the token and the source of the leak. In the future, it’s crucial that you remain extra cautious about not leaking your tokens publicly online. You can read more about the good practices to manage secrets in the OWASP Secrets Management Cheat Sheet.