Credential safety

Security

Practical steps for protecting API and webhook credentials.

API key safety

Keep keys in environment variables or a secret manager.
Do not place keys in browser bundles, source control, screenshots, or public notebooks.
Use HTTPS for every request.
Regenerate a key immediately if it may have been exposed.

Verify every webhook signature before trusting its contents. Keep each signing secret separate from the receiving application code.