# Security Best Practices

> Source: https://agilitycms.com/docs/training-guide/architect-security

This guide covers security best practices for Agility CMS implementations, including API security, authentication, and access control.

## API Security

### API Key Management

**Best Practices:**
- Never commit API keys to version control
- Use environment variables
- Rotate keys periodically
- Use different keys for different environments
- Restrict key permissions when possible

### API Key Types

- **Fetch Key**: For production content access
- **Preview Key**: For draft content access
- **Security Key**: For webhook validation

### Secure API Calls

- Use HTTPS for all API calls
- Validate API keys server-side
- Monitor API usage
- Set up rate limiting if needed

## Webhook Security

### Webhook Validation

Validate webhook signatures:

```typescript
const securityKey = request.headers.get("x-agility-security-key")
if (securityKey !== process.env.AGILITY_SECURITY_KEY) {
  return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
}
```

### Webhook Best Practices

- Validate webhook signatures
- Use security keys for validation
- Whitelist webhook endpoints
- Monitor webhook activity
- Handle webhook errors gracefully

## Access Control

### Role-Based Access

Agility CMS uses role-based access control:
- **Built-in Roles**: Reader, Contributor, Editor, Publisher, etc.
- **Custom Roles**: Enterprise feature for custom permission combinations
- **Item-Level Permissions**: Granular access control

### Permission Levels

- **Read**: View content only
- **Contribute**: Create and edit own content
- **Edit**: Edit any content
- **Approve**: Approve content for publishing
- **Publish**: Publish content
- **Manage**: Full management access
- **Full Control**: Complete instance access

## Content Security

### Input Validation

- Validate all user input
- Sanitize HTML content
- Use TypeScript for type safety
- Handle edge cases

### Content Sanitization

Agility CMS automatically sanitizes:
- Rich text content
- HTML content
- User-generated content

## Best Practices

1. **API Key Security**: Never expose API keys
2. **Webhook Validation**: Always validate webhook signatures
3. **Access Control**: Use appropriate roles and permissions
4. **Input Validation**: Validate all user input
5. **Monitoring**: Monitor for suspicious activity
6. **Regular Updates**: Keep dependencies updated
7. **Security Audits**: Regular security reviews

---

**Next**: [Integrations](./architect-integrations) - Integration patterns