---
title: Security
description: Protect job inputs, outputs, controls, and provider credentials.
pagination: false
sidebar:
  icon: shield-check
---

Control who can submit work, read its results, and request job operations.

> **Before you begin**
>
> Use an existing [task/job with its selected provider installed and
> bound](/docs/modules/jobs/quickstart) before running this example. Core task declarations do not
> install the provider's native SDK.

Jobs are private unless their `client` policy sets `public: true` or provides `authorize`. Public means
the selected operations are exposed; it does not disable input validation, admission, authorization, or
output limits.

```ts title="examples/commerce/src/services/orders/jobs/export-orders.job.ts"
/** Registers the export task as a public job exposing trigger, get, list and watch with progress/output fields. */
import { defineJob } from "@relkit/app/jobs";
import exportOrders from "../tasks/export-orders.task.js";

const exportOrdersJob = defineJob({
  name: "exportOrders",
  id: "orders.export-orders",
  task: exportOrders,
  client: {
    public: true,
    operations: ["trigger", "get", "list", "watch"],
    fields: ["status", "progress", "output"],
  },
});

export default exportOrdersJob;
```

- Authorize the caller before triggering, reading, watching, cancelling, or retrying a run.
- Scope every lookup by tenant or account; opaque run IDs are not authorization.
- Validate persisted input again inside the task before side effects.
- Redact secrets and personal data from logs, progress, stream items, and error details.
- Keep provider tokens in secret configuration and expose only their names in deployment plans.
- Treat client fingerprints, task versions, and schema hashes as compatibility metadata, not credentials.

Use the Inspector only on a protected local or operator network. The local admin endpoint must not be exposed publicly without an authenticated proxy.

{/* Generated by apps/docs/scripts/generate.ts. Do not edit. */}

**Reference and source**

- [`@relkit/jobs` API](/docs/api/jobs)
- [`@relkit/client` API](/docs/api/client)

- [`examples/commerce/src/services/orders/jobs/export-orders.job.ts`](https://github.com/rel-kit/relkit/blob/main/examples/commerce/src/services/orders/jobs/export-orders.job.ts)