Protect every secret

API keys and webhooks may provide access to distribution, email, payment or storage services. Treat them like administrator passwords.

  • Store secrets in environment variables or protected server configuration.
  • Never place private keys in public JavaScript or public repositories.
  • Use separate credentials for testing and production.
  • Grant the smallest available permission scope.
  • Rotate a key immediately when exposure is suspected.

Third-party access

Document which services are connected, who owns each account and how access can be revoked. Remove integrations that are no longer used.

Key rotation

After creating a replacement key, update the application, test the integration and then revoke the old key.