Skip to main content

How do I keep my API keys secure?

Follow these best practices to keep your API keys safe:

  • Assign only the permissions each key actually needs (Create, Read, Update, Delete)
  • Never share API keys publicly or include them in client-side code
  • Never commit API keys to a public Git repository — use environment variables instead
  • Add your .env file to .gitignore to prevent accidental exposure
  • Delete keys that are no longer in use
  • If a key is compromised, delete it immediately and create a new one

You can manage your API keys in Settings → API / MCP.