Skip to content

Key management & security

An API key is the credential for your partner account. If it leaks, a third party can call the API with your partner's permissions.

Never expose your key to clients

  • Do not embed the key in client code such as browser JavaScript or mobile apps. It is exposed as-is through bundles and decompilation. Always route API calls through your own server.
  • Do not commit the key to a source repository (git). Public or private, it becomes a leak path.
  • If you suspect a leak, revoke (reissue) the key immediately and let us know. Calls made with a leaked key may be treated as the partner's responsibility — see the API usage policy.

Store keys safely

  • Store the key in environment variables or a secrets manager on your server.
  • If you must keep it in a config file, exclude the file from version control (.gitignore) and keep access permissions to a minimum.
  • Mask the key so it never appears in logs or error reports.

If a key is compromised

  1. Revoke the key immediately by contacting us.
  2. Get a new key and update your server configuration — see Issue an API key.
  3. If you need a review of the calls made while the key was exposed, include the relevant details (time range, what you observed) in your request.