| name | palantir-security-basics |
| description | Apply Palantir Foundry security best practices for credentials, scopes, and access control.
Use when securing API tokens, implementing least privilege access,
or auditing Foundry security configuration.
Trigger with phrases like "palantir security", "foundry secrets",
"secure palantir", "palantir API key security", "foundry scopes".
|
| allowed-tools | Read, Write, Grep |
| version | 1.5.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","palantir","foundry","security","oauth"] |
| compatibility | Designed for Claude Code |
Palantir Security Basics
Overview
Security best practices for Foundry API tokens, OAuth2 credentials, scope management, and secret rotation. Covers both personal access tokens (dev) and service user credentials (production).
Prerequisites
- Foundry Developer Console access
- Understanding of OAuth2 scopes
Instructions
Step 1: Secure Credential Storage
FOUNDRY_HOSTNAME=mycompany.palantirfoundry.com
FOUNDRY_CLIENT_ID=your-client-id
FOUNDRY_CLIENT_SECRET=your-client-secret
echo '.env' >> .gitignore
echo '.env.local' >> .gitignore
echo '.env.*.local' >> .gitignore
For production, use a secrets manager:
aws secretsmanager create-secret --name foundry/prod \
--secret-string '{"client_id":"xxx","client_secret":"yyy","hostname":"zzz"}'
echo -n "your-client-secret" | gcloud secrets create foundry-client-secret --data-file=-
vault kv put secret/foundry client_id=xxx client_secret=yyy
Step 2: Apply Least Privilege Scopes
| Environment | Recommended Scopes | Rationale |
|---|
| Development | api:read-data | Read-only prevents accidental mutations |
| Staging | api:read-data, api:write-data | Test writes in safe environment |
| Production | Only scopes your app actually needs | Minimize blast radius |
auth = foundry.ConfidentialClientAuth(
client_id=os.environ["FOUNDRY_CLIENT_ID"],
client_secret=os.environ["FOUNDRY_CLIENT_SECRET"],
hostname=os.environ[],
scopes=[],
)
