---
title: Security
description: Protect Zorveus credentials, OAuth flows, provider secrets, and webhook endpoints.
---

Use the least-privileged credential for each surface:

- Keep service keys, confidential OAuth client secrets, and provider credentials on trusted servers.
- Scope API keys to the required models and connection.
- Store returned secrets immediately because key and secret creation responses may be the only time the full value is shown.
- Rotate and revoke credentials when they are exposed or no longer needed.

OAuth uses authorization code with S256 PKCE and exact registered redirect URIs. Generate a fresh verifier and state value for each attempt, verify state on return, and exchange the code from a trusted backend for confidential clients.

Zorveus stores provider credentials through its protected credential service. Your own logs, traces, and error reports must still redact Authorization headers, API keys, OAuth codes, PKCE verifiers, client secrets, and webhook secrets.

For webhooks, verify the signature against the raw request body before parsing or processing the event.