Securing your API keys
Essential practices to protect your credentials and prevent unauthorized usage.
- Copy the secret key immediately upon creation. Mijatovic reveals the full key only once.
- Store keys in server-side environment variables or a trusted secret management system.
- Never commit API keys into source control repositories, client-side bundles, or public websites.
- If you suspect an API key has been exposed, revoke it immediately in Platform → API Keys.
- Generate a replacement key to take the place of the revoked credential.