Securing your API keys

Your secret key is shown exactly once. Treat it like a password.

Do

• Keep keys in environment variables, not in source code.
• Use separate keys per server or app, so one can be revoked alone.
• Lock live keys to your server IPs with the IP whitelist.
• Rotate keys when a team member leaves.

Do not

• Put a secret key in a mobile app, browser JavaScript or a public repository.
• Share keys over chat or email.

If a key leaks

Revoke it under Developers › API keys. It stops working immediately. Create a new one and update your server. The API log shows every call and its IP if you need to investigate.