Integration credentials and signing

​

Principles

• A secret is shown once, or never. Secrets Coverbase generates for you are displayed at creation and cannot be read back. Secrets you give Coverbase are write-only: no page or API response returns them.
• Credentials live in a secrets manager, not the database. The database keeps a pointer and non-secret metadata, such as which fields are set, a key fingerprint or a service account email.
• A credential is scoped to its owner. Each is stored under its organization and its connection or destination, and deleting the connection or destination deletes the credential.
• A body is never trusted on its own. Webhooks in both directions are signed with HMAC-SHA256 over the raw bytes, and inbound webhooks only start a sync that re-reads the data from its source.

​

OAuth client secrets

• Shown once. The client secret is displayed when the client is created and never again. Coverbase stores only its SHA-256 digest and its last four characters, so a client can be told apart without the secret being readable.
• High-entropy and hashed. Client secrets and access tokens are random 256-bit values, stored only as SHA-256 digests. The token endpoint compares digests in constant time, and does the comparison even for an unknown client ID, so response timing does not reveal which client IDs exist. A token request must use one client authentication method, HTTP Basic or form fields, not both.
• Short-lived tokens. An access token lasts between five minutes and an hour, set per client, and the token response carries Cache-Control: no-store.
• Capped per client. A client holds at most 50 live tokens. Requesting another revokes its oldest, so a leaked secret looping on the token endpoint cannot pile up grants.
• No escalation. Only an admin signed in to the dashboard can grant elevated scopes to a client, as with ak_* keys. A token request can only narrow the client’s scopes.
• Immediate revocation. Revoking a client deletes every token it issued, and a client stops getting tokens if the third-party lifecycle features are turned off for your organization. A server that cached a token’s identity can keep accepting it for a few seconds.
• Audited. Creating and revoking clients is recorded in the activity log, and every call made with a token is recorded in the public API audit log, like a call made with a key.

​

Connector credentials

​

Warehouse destination credentials

​

Customer S3 roles and external IDs

• A per-destination external ID. When you save the destination, Coverbase generates an external ID for it, starting with coverbase-, and shows it on the destination with a ready-made trust policy. Your role’s trust policy requires that external ID, so the role cannot be assumed for any other customer’s destination, even if someone learns its ARN. This is the protection AWS recommends against the confused deputy problem.
• One named principal. The trust policy names a single, dedicated Coverbase role whose only job is assuming customer share roles. Coverbase’s services reach your role only through it, and its ARN stays the same if those services are redeployed.
• Coverbase’s side is constrained too. That role is permitted to assume a role only when the request carries a coverbase- external ID and the role is outside Coverbase’s own AWS account, and a destination naming a role in Coverbase’s account is refused when it is saved.
• Least privilege. The role needs only s3:PutObject under the prefix you choose. You can remove the trust at any time to cut access.

​

Outbound webhooks

​

Inbound integration webhooks

• Signed with a per-connection secret. The X-Coverbase-Signature header has the form t=<unix seconds>,v1=<hex>, where the digest is HMAC-SHA256 of <t>. followed by the raw body, keyed by the connection’s signing secret. The secret is shown once, when it is created or rotated.
• Replay-resistant. The timestamp is inside the signature and must be within five minutes of Coverbase’s clock.
• Verified before anything happens. Coverbase verifies the signature before it reads the payload or does anything else. A missing or wrong signature returns 401, and a body over 256 KB is refused.
• A nudge, not data. A valid call only starts a sync, and the sync re-reads every record from the provider’s API with Coverbase’s stored credentials. Even a correctly signed body cannot write a value into Coverbase.

​

Related