Security Best Practices

This guide covers security best practices for Agility CMS implementations, including API security, authentication, and access control.

API Security

API Key Management

Best Practices:

• Never commit API keys to version control
• Use environment variables
• Rotate keys periodically
• Use different keys for different environments
• Restrict key permissions when possible

API Key Types

• Fetch Key: For production content access
• Preview Key: For draft content access
• Security Key: For preview key validation (not webhooks)

Secure API Calls

• Use HTTPS for all API calls
• Validate API keys server-side
• Monitor API usage
• Set up rate limiting if needed

Webhook Security

Webhook Validation

Tick Enable secure delivery on each webhook in Settings > Webhooks. Agility then signs every request with that webhook's own whsec_ signing secret, and your endpoint verifies the signature before it acts on the payload. See Verifying Signed Webhooks.

Don't check the instance Security Key on a webhook endpoint. Agility never sends it with a webhook; it is used for preview key validation.

Webhook Best Practices

• Validate webhook signatures
• Verify each webhook's whsec_ signing secret
• Whitelist webhook endpoints
• Monitor webhook activity
• Handle webhook errors gracefully

Access Control

Role-Based Access

Agility CMS uses role-based access control:

• Built-in Roles: Reader, Contributor, Editor, Publisher, etc.
• Custom Roles: Enterprise feature for custom permission combinations
• Item-Level Permissions: Granular access control

Permission Levels

• Read: View content only
• Contribute: Create and edit own content
• Edit: Edit any content
• Approve: Approve content for publishing
• Publish: Publish content
• Manage: Full management access
• Full Control: Complete instance access

Content Security

Input Validation

• Validate all user input
• Sanitize HTML content
• Use TypeScript for type safety
• Handle edge cases

Content Sanitization

Agility CMS automatically sanitizes:

• Rich text content
• HTML content
• User-generated content

Best Practices

1. API Key Security: Never expose API keys
2. Webhook Validation: Always validate webhook signatures
3. Access Control: Use appropriate roles and permissions
4. Input Validation: Validate all user input
5. Monitoring: Monitor for suspicious activity
6. Regular Updates: Keep dependencies updated
7. Security Audits: Regular security reviews

---

Next: Integrations - Integration patterns