Security Is an Architectural Decision, Not a Finishing Touch

Securing APIs has become a critical engineering responsibility as the developer productivity tool Shiplogue has transitioned from a local IDE extension to a cloud-based service. Shiplogue captures commits, coding-agent activity, and reviews, then compiles them into daily standups that developers can review and share across various platforms like VS Code, Cursor, and Antigravity.

To ensure the security of its cloud infrastructure, project-based access, and integrations, the developers at Shiplogue have implemented OAuth 2.0 and JSON Web Tokens (JWT) for authorization and token validation. The tutorial on securing REST APIs using OAuth 2.0 and JWT is particularly valuable for understanding the distinction between authentication and authorization. OAuth 2.0 handles delegated authorization, while JWT serves as a token format that carries verifiable claims.

The tutorial emphasizes that OAuth 2.0 and JWT are not competing technologies; instead, they complement each other in a comprehensive security model. JWTs carry claims that can be validated to confirm the identity of the user, the intended audience, and the permissions associated with the token. Protecting API endpoints, managing scopes, roles, and custom permissions, and validating token signatures are all crucial aspects of securing Shiplogue's cloud infrastructure.

As Shiplogue has grown beyond a local IDE extension into a cloud-backed service, the developers have had to make various architectural decisions to ensure data minimisation, project-level isolation, and access control. They utilize OS-level keychains for storing credentials and hash connector keys at rest, ensuring that only sanitized activity metadata and diff summaries are synced to the cloud when enabled.

Dashboard access is restricted to authenticated workspace members, and the developers continuously evaluate security considerations as the product evolves.