How do you secure the Magento API (OAuth / token)?

We never expose admin credentials. Server-to-server integrations use integration tokens or OAuth 1.0a scoped to the minimum ACL resources the integration actually needs. Secrets live in environment config or a secrets manager, never in code or the repo. Inbound webhooks are verified by signature/HMAC, traffic is TLS-only, and middleware sits behind allow-lists where appropriate. Every integration gets its own credentials so access can be revoked independently.