Is using tokens safe?

[EpicEfeathers]

I would like to run a cron-job for a website that needs a token. Is saving the token under a header safe? Will anyone else be able to find it or see it?

Thanks for the help.

[pschlan]

We as a service operator could see them. (We need to be able to decode them anyway since we have to know the plain text latest when we submit the request.)

If you want to avoid that, I would recommend to add some sort of proxy script on your side, and let our service authenticate to that one using another token just for this purpose.

(Of course we're doing our best to protect all customer data and never share it with others. But it's always good to defend in depth.)

[EpicEfeathers]

I've restricted the token's permissions pretty thoroughly. For now, I think it will be secure enough. This isn't anything that needs such tight security.

Thanks for the response!