Voznest Forge

Workspace

WorkspaceProjects

Development

DocsAPI ReferenceSDKsEmbed StudioChangelog
  1. Forge
  2. /Docs

Start here

Getting StartedQuickstartPlatform ConceptsEnvironments

Build

ProjectsIdentityAgentsGatewayCapabilitiesPermissions ReferenceInstallationsLive activity

Commands & interactions

CommandsContext-menu CommandsInteractionsComponentsModals (Forms)Activities (Embedded Apps)

Acting in hubs

MessagesEmbedsEmbeds v2 (Blocks)Embeds v3Incoming WebhooksHub Management APIEvent StreamDelivery

Sign in with Voznest

AccessOpenID Connect

API

APIAuthenticationErrorsRate LimitsSecurity

Publish & operate

App Market & ListingTemplates & SandboxObservability & Team Tools

Tools

SDKsExamplesFAQ & TroubleshootingReference

API

Security

How the platform protects your project — and what you should do.

  • Tokens, keys and client secrets are stored only as hashes; delivery secrets and signing keys are encrypted at rest. None can be read back — only rotated.
  • Every change to a project is written to an append-only audit trail: who, what, which environment, and the result.
  • Production credentials can only be managed by Managers and the Owner.
  • Reusing a rotated OAuth refresh token revokes the whole authorization.
  • Delivery never connects to private networks and signs every request twice.

Your checklist

  1. 1Rotate regularlyRotate credentials older than 90 days. Security in the portal flags them.
  2. 2Use the smallest scopeGive API keys only the scopes the job needs, and an IP allowlist for CI.
  3. 3Require PKCEKeep PKCE required in Access, especially for mobile and single-page apps.
  4. 4Verify every deliveryCheck the signature and timestamp before trusting a delivery; de-duplicate on the event id.
  5. 5Separate environmentsTest with Development agents in test hubs — never with production tokens.
PreviousRate LimitsNext App Market & Listing