Security Best Practices

This guide covers security best practices for Agility CMS implementations, including API security, authentication, and access control.

API Security

API Key Management

Best Practices:

  • Never commit API keys to version control
  • Use environment variables
  • Rotate keys periodically
  • Use different keys for different environments
  • Restrict key permissions when possible

API Key Types

  • Fetch Key: For production content access
  • Preview Key: For draft content access
  • Security Key: For webhook validation

Secure API Calls

  • Use HTTPS for all API calls
  • Validate API keys server-side
  • Monitor API usage
  • Set up rate limiting if needed

Webhook Security

Webhook Validation

Validate webhook signatures:

const securityKey = request.headers.get("x-agility-security-key")
if (securityKey !== process.env.AGILITY_SECURITY_KEY) {
  return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
}

Webhook Best Practices

  • Validate webhook signatures
  • Use security keys for validation
  • Whitelist webhook endpoints
  • Monitor webhook activity
  • Handle webhook errors gracefully

Access Control

Role-Based Access

Agility CMS uses role-based access control:

  • Built-in Roles: Reader, Contributor, Editor, Publisher, etc.
  • Custom Roles: Enterprise feature for custom permission combinations
  • Item-Level Permissions: Granular access control

Permission Levels

  • Read: View content only
  • Contribute: Create and edit own content
  • Edit: Edit any content
  • Approve: Approve content for publishing
  • Publish: Publish content
  • Manage: Full management access
  • Full Control: Complete instance access

Content Security

Input Validation

  • Validate all user input
  • Sanitize HTML content
  • Use TypeScript for type safety
  • Handle edge cases

Content Sanitization

Agility CMS automatically sanitizes:

  • Rich text content
  • HTML content
  • User-generated content

Best Practices

  1. API Key Security: Never expose API keys
  2. Webhook Validation: Always validate webhook signatures
  3. Access Control: Use appropriate roles and permissions
  4. Input Validation: Validate all user input
  5. Monitoring: Monitor for suspicious activity
  6. Regular Updates: Keep dependencies updated
  7. Security Audits: Regular security reviews

Next: Integrations - Integration patterns