The outcome

Expose an agent or tool without leaking personal tokens, confusing tenant authority, mishandling end-user data, or allowing replayed side effects.

Step by step

A workflow you can repeat.

  1. 01

    Map end users, developer workspace, agent, OAuth app or personal token, plugin API, third parties, data fields, permissions, notices, consent, side effects, quotas, retention, and incident owners.

  2. 02

    Prefer OAuth or dedicated scoped service credentials for production, keep every secret server-side, separate environments and tenants, set expiry and rotation, and never share one personal token across users.

  3. 03

    Validate signatures and schemas, canonicalize identifiers and URLs, bind requests to the authenticated user and tenant, enforce authorization at the plugin API, and reject unknown fields and destinations.

  4. 04

    Make writes idempotent, require confirmation for messages, publication, purchases and account changes, use timeouts and rate limits, redact logs, and return bounded responses with no credentials or excessive records.

  5. 05

    Test token leak and revocation, forged identity, tenant crossover, prompt injection, SSRF, replay, duplicate calls, timeouts, credit exhaustion, consent withdrawal, deletion and rollback before canarying.

Working standard

What good use looks like.

  • Keep all Coze tokens server-side.
  • Authorize at the plugin service.
  • Make external writes idempotent.

Official references

Check the current product documentation.