Sign in
Security

Key safety

A key is a password for your account's data. Treat it like one.

Do

  • Keep keys in environment variables or a secrets manager.
  • Give each app or server its own key, with only the permissions it needs.
  • Use an IP allowlist for keys that run on a server.
  • Use test keys for development and CI.

Do not

  • Commit keys to Git, paste them in chats, or put them in screenshots.
  • Use a key in browser JavaScript, a mobile app or a desktop app you give to other people.
  • Share one key between several people.

Expiry and rolling

Keys expire 90 days after they are created. We remind you by Telegram and email 7 days before. Roll a key in the dashboard to get a new one with the same settings; the old key keeps working for 24 hours so you can swap it without downtime.

Viewing a key again

You can show a key again in the dashboard after confirming it is you (your password, or a code we send to your Telegram and email).

If a key leaks

  1. Revoke it in the dashboard right away. It stops working on the next request.
  2. Create a new key and update your app.
  3. Check the request log for calls you do not recognise.

v1 is read-only, so a leaked key cannot spend your balance or change anything, but it can read the data its permissions allow.