Knowledge base
Using API keys safely
Scope them, keep them out of your code, and rotate the one you pasted somewhere by accident.
An API key is a password that does not expire and that nobody watches. Treat it like one.
Give it only what it needs
Create a key per integration, with only the permissions that integration uses. A deployment script does not need billing access, and a monitoring tool does not need to delete sites. When something goes wrong, a narrow key limits what went wrong with it.
Keep it out of your code
Never commit a key to a repository — public or private. Repositories get forked, cloned, backed up and mis-shared, and scanners find keys in them within minutes of a push. Use an environment variable or your CI provider's secret store.
Rotate rather than worry
If a key has been pasted into a chat, a ticket, a screenshot or a log, replace it. Create the new key, switch the integration over, then delete the old one — in that order, so nothing breaks in between. It takes a minute and removes the question entirely.
Watch what they do
Every call a key makes appears in Activity, with the key's name. If a key you thought was retired is still making calls, that tells you something worth knowing.
Deleting
Deleting a key takes effect immediately. Anything using it starts getting 401, which is the point.
Still stuck?
Support is included on every plan and answers in your own language.
Contact support → All articles →