salesloft-security-basics

name	salesloft-security-basics
description	Secure SalesLoft OAuth tokens, API keys, and webhook signatures. Use when implementing token rotation, securing webhook endpoints, or auditing SalesLoft API access controls. Trigger: "salesloft security", "salesloft secrets", "secure salesloft", "salesloft token rotation".
allowed-tools	Read, Write, Grep
version	1.6.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","sales","outreach","salesloft"]
compatibility	Designed for Claude Code

SalesLoft Security Basics

Overview

Secure SalesLoft API integrations: OAuth token management, webhook signature verification, secret storage, and scope-based access control. SalesLoft uses OAuth 2.0 bearer tokens and HMAC-SHA256 webhook signatures.

Instructions

Step 1: Secret Storage

# .gitignore -- NEVER commit credentials
.env
.env.local
.env.*.local

# .env
SALESLOFT_CLIENT_ID=app-client-id
SALESLOFT_CLIENT_SECRET=app-secret
SALESLOFT_WEBHOOK_SECRET=webhook-signing-secret

// Validate secrets at startup
const required = ['SALESLOFT_CLIENT_ID', 'SALESLOFT_CLIENT_SECRET'];
for (const key of required) {
  if (!process.env[key]) throw new Error(`Missing required env: ${key}`);
}

Step 2: Token Lifecycle Management

// Store tokens securely with expiry tracking
interface TokenStore {
  accessToken: string;
  refreshToken: string;
  expiresAt: number; // Unix timestamp
}

async function getValidToken(store: TokenStore): Promise<string> {
  // Refresh 5 minutes before expiry
  if (Date.() > (store. - ) * ) {
     refreshed =  (store.);
    store. = refreshed.;
    store. = refreshed.;
    store. = .(.() / ) + refreshed.;
     (store); 
  }
   store.;
}