Headless 360Architect (Hardest)zero-trustsecurityoauthmTLS
Secure headless API exposure with zero-trust principles
Real World Scenario
Pen test found partner API keys embedded in mobile app binaries and excessive OAuth scopes on integration users.
Expected Answer
• Never embed long-lived secrets in mobile apps—use short-lived tokens via backend-for-frontend
• Implement mTLS for server-to-server partner integrations
• Scoped OAuth policies per API resource with regular access reviews
• Rotate credentials automatically via secrets manager integration
• WAF and bot detection on public API endpoints
• Principle of least privilege on Salesforce integration user profiles
• Continuous scanning for leaked keys in app store binaries
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Never embed long-lived secrets in mobile apps—use short-lived tokens via backend-for-frontend Also consider: Implement mTLS for server-to-server partner integrations In practice: Scoped OAuth policies per API resource with regular access reviews Document the decision in an ADR and align with enterprise standards.
Architect Perspective
Mobile binaries are hostile environments—architect BFF layer holding secrets, not client apps.