API key security
Never expose keys client-side
API keys grant access to your wallet balance. Never include them in:- Browser JavaScript
- Mobile application code
- Public repositories
- Client-side network requests
Use environment variables
Store keys as environment variables:Rotate compromised keys
If a key is compromised:- Revoke it immediately in the Dashboard
- Create a new key
- Update all applications using the old key
- Review usage logs for unauthorized activity
HTTPS only
All API requests must use HTTPS. HTTP requests are not accepted.Logging
When logging API requests, redact API keys and sensitive data. Never log full API keys in plaintext.Webhook security
Stripe webhooks are verified using thestripe-signature header. Ensure STRIPE_WEBHOOK_SECRET is configured correctly.