If you’re using access tokens, make sure to implement the following: Use strong authentication mechanisms like OAuth 2.

0 or OpenID Connect for your API calls. If you can’t use these standards, use JWT (JSON Web Tokens) with a secret key that is not exposed in your codebase or client-side libraries.

Generate and invalidate access tokens properly. Don’t leak them via server logs or other vulnerabilities! Learn more about how to do this here
https://t.co/FV7Bmbpi18