Because the API Key and Secret are similar to a username and password, they should be treated with the highest level of confidentiality. These are standard recommendations.
- Do not embed secrets in client-side code
- Never hard-code secrets into application source code, especially for web or mobile apps. This exposes credentials to anyone using an app.
- Use environment variables
- Store secrets in environment variables on your server or use a secure secrets management tool.
- Periodically regenerate secrets or use access tokens
- Secrets, like passwords, become more vulnerable over time and should be regenerated.
- Rotate keys regularly
- Periodically generate new Key and Secret pairs and revoke old ones.
- Use access tokens for API requests
- For heightened security, use access tokens. Access tokens expire after a set period, which reduces the risk of long-term exposure.
- Support for key rotation
-
A Data Integrity Suite workspace allows multiple API keys. This enables you to generate a new key and secret, update your applications to use the new credentials, and then revoke the old key without interrupting service.
- One-time visibility of API secrets
-
The API Secret value is displayed only once at the time the key is created. If the secret is lost, it must be regenerated or a new API key must be created. Store secrets securely when they are first generated.
- Revoke unused or compromised keys
-
When rotating credentials or when a key is no longer required, revoke the old API key to reduce the risk of unauthorized access.