OAuth & Token Security
Dalmia Computers uses provider-controlled authorization screens and HTTPS callbacks on approved domains to connect supported services without asking users to disclose provider passwords.
Redirect security
Production OAuth redirect URLs are absolute HTTPS locations on domains controlled by Dalmia Computers unless a provider explicitly requires another approved callback mechanism. Redirects are configured to match provider requirements exactly.
Secrets and tokens
Client secrets, API keys, access tokens and refresh tokens are confidential. They must not be committed to public source code, displayed in public pages, included in screenshots, or sent through ordinary chat. Server-side storage and encrypted credential handling are used where supported.
Least privilege
Integrations should request only the scopes required for an enabled feature. High-impact actions such as publishing, messaging, payments or financial writes remain subject to provider permissions and Dalmia approval controls.
Revocation
Provider connections can be revoked through provider controls. Eligible locally stored provider-linked data can be requested for deletion through Data Deletion.