Security Best Practices

This guide covers security best practices for Agility CMS implementations, including API security, authentication, and access control.

API Security

API Key Management

Best Practices:

• Never commit API keys to version control
• Use environment variables
• Rotate keys periodically
• Use different keys for different environments
• Restrict key permissions when possible

API Key Types

• Fetch Key: For production content access
• Preview Key: For draft content access
• Security Key: For webhook validation

Secure API Calls

• Use HTTPS for all API calls
• Validate API keys server-side
• Monitor API usage
• Set up rate limiting if needed

Webhook Security

Webhook Validation

Validate webhook signatures:

const securityKey = request.headers.get("x-agility-security-key")
if (securityKey !== process.env.AGILITY_SECURITY_KEY) {
  return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
}

Webhook Best Practices

• Validate webhook signatures
• Use security keys for validation
• Whitelist webhook endpoints
• Monitor webhook activity
• Handle webhook errors gracefully

Access Control

Role-Based Access

Agility CMS uses role-based access control:

• Built-in Roles: Reader, Contributor, Editor, Publisher, etc.
• Custom Roles: Enterprise feature for custom permission combinations
• Item-Level Permissions: Granular access control

Permission Levels

• Read: View content only
• Contribute: Create and edit own content
• Edit: Edit any content
• Approve: Approve content for publishing
• Publish: Publish content
• Manage: Full management access
• Full Control: Complete instance access

Content Security

Input Validation

• Validate all user input
• Sanitize HTML content
• Use TypeScript for type safety
• Handle edge cases

Content Sanitization

Agility CMS automatically sanitizes:

• Rich text content
• HTML content
• User-generated content

Best Practices

1. API Key Security: Never expose API keys
2. Webhook Validation: Always validate webhook signatures
3. Access Control: Use appropriate roles and permissions
4. Input Validation: Validate all user input
5. Monitoring: Monitor for suspicious activity
6. Regular Updates: Keep dependencies updated
7. Security Audits: Regular security reviews

---

Next: Integrations - Integration patterns