How to Secure Your API Keys

Last updated: October 14, 2026

API keys provide access to your account and systems. This article explains how to handle them properly to prevent unauthorized access and potential data exposure.

Do not share your API keys

  • Never share API keys in emails, chat tools, or support tickets.

  • Do not expose keys in client-side code or public repositories.

If a key is accidentally shared, revoke it immediately and generate a new one.

Store API keys securely

  • Use environment variables or a secure secret manager.

  • Avoid hardcoding keys directly into your application.

  • Restrict access to keys to only the systems and team members that require them.

Rotate API keys regularly

  • Set an expiration date where possible.

  • Replace keys periodically as part of your security routine.

  • Immediately rotate keys if you suspect compromise.

Follow the steps below if you believe an API key has been compromised:

  1. Disable or delete the key immediately.

  2. Generate a new API Key.

  3. Update your application configuration with the new key.

API keys cannot be recovered once lost. Treat them as sensitive credentials and manage them with the same care as your passwords.