Knowledge base

Using API keys safely

Scope them, keep them out of your code, and rotate the one you pasted somewhere by accident.

An API key is a password that does not expire and that nobody watches. Treat it like one.

Give it only what it needs

Create a key per integration, with only the permissions that integration uses. A deployment script does not need billing access, and a monitoring tool does not need to delete sites. When something goes wrong, a narrow key limits what went wrong with it.

Keep it out of your code

Never commit a key to a repository — public or private. Repositories get forked, cloned, backed up and mis-shared, and scanners find keys in them within minutes of a push. Use an environment variable or your CI provider's secret store.

Rotate rather than worry

If a key has been pasted into a chat, a ticket, a screenshot or a log, replace it. Create the new key, switch the integration over, then delete the old one — in that order, so nothing breaks in between. It takes a minute and removes the question entirely.

Watch what they do

Every call a key makes appears in Activity, with the key's name. If a key you thought was retired is still making calls, that tells you something worth knowing.

Deleting

Deleting a key takes effect immediately. Anything using it starts getting 401, which is the point.

All developer docs →

Latest from the blog

What we have been writing about hosting, SEO and running sites at scale.

SEO and Link Building from the Hosting Layer: A 2026 Operator's View

How hosting shapes indexing and link equity in 2026: keeping pages indexed, vetting aged domains before you build on them, link building without a footprint, and an honest line on what infrastructure can and cannot do for SEO.

Read the post →

Making WordPress Fast and Secure: A Performance and Plugin Checklist

A practical checklist for fast, secure WordPress: server-level caching, a per-site object cache, the handful of plugins worth running, keeping the stack current, and the WooCommerce pages you must never cache.

Read the post →

How to Choose Managed Web Hosting in 2026: A Buyer's Guide

What actually separates good managed hosting from a cheap box with a control panel — migrations, backups, isolation, real caching and honest scaling — and how to judge it before you commit.

Read the post →

Read the blog →

Still stuck?

Support is included on every plan, the desk is open 24 hours a day, and you can write to us in any of our 58 languages — we answer you in yours.

Contact support → All articles →