Security

Credential handling

Treat the API key as a secret. Load it from a secret manager or protected runtime configuration. Never commit it.

URL confinement

The SDK requires an explicit deployment URL. Absolute raw-request and pagination URLs must remain in the configured API origin and path. This prevents a server-returned or caller-provided external URL from receiving the Okatana bearer token.

Redirects

The default JDK client is built with HttpClient.Redirect.NEVER. If you inject a client, configure redirect behavior deliberately.

Sensitive content

Tickets and documents can contain rich HTML and operational information. Avoid logging request bodies and full response bodies by default.

Scope minimization

Use the smallest credential scope set possible. documents:read can expose organization documents through the external contract, so protect document-reading credentials carefully.

TLS

Use HTTPS for production deployments. If private PKI is required, configure a trusted SSLContext on the injected HttpClient; do not disable certificate or hostname validation.