API authentication
Create scoped API keys in Dashboard and transmit them only in the documented authorization header.
Reveal once
A newly created secret is displayed once. Store it immediately in a secret manager; only its non-secret prefix and hash remain in the platform.
Least privilege
Use separate keys for environments and integrations. Revoke a key that is exposed or no longer needed.
Server-side only
Never ship a production key in public JavaScript, a browser extension build, a mobile binary, a source repository, or a query string.