API access best practice

Short answer: give StackTether its own API user in each vendor system, with view-only rights to just the data its tools read, and never a person's login. Store the credentials only in StackTether (and your password manager), rotate them on a schedule, and revoke them the moment you stop using StackTether. Every StackTether tool is read-only today, so read-only API users are all you need.

Guides in this section

• Read-only access first: why StackTether needs only read access, and the rules for a safe API user (dedicated, least privilege, one per MSP, rotation, vendor-side auditing, offboarding).
• Read and write access (future): how write tools will be controlled when they arrive, and how to prepare without weakening today's setup.
• Permissions by vendor: the read-only role or scope for each vendor, next to what a read-write setup would need, with links to official docs.

The checklist

1. One dedicated API user (or API app) per vendor, named for StackTether.
2. View, query or read rights only. No add, edit, delete, run or remote-control rights.
3. No access to prices, costs, invoices or billing unless a tool needs it (none does today).
4. A monitored mailbox on the API user, so vendor alerts reach someone.
5. Credentials entered only on StackTether's Connections page and kept in your password manager.
6. A rotation date in your calendar (for example every 90 days or whenever an admin leaves).
7. Vendor access in StackTether turned on only for the people who need it.