We’re building Stashbase.dev around this. The agent makes API calls through a proxy that holds the upstream credentials, with access restricted by host, method and path. Revoking the session cuts off further proxy access even if the agent is still running.
The awkward part is deciding how narrow to make those rules. An allowed endpoint can still do something you didn’t want. Are method/path restrictions enough for your use case?
The awkward part is deciding how narrow to make those rules. An allowed endpoint can still do something you didn’t want. Are method/path restrictions enough for your use case?