API keys provide programmatic access to Buaze data. Treat them like passwords: keep scope minimal, store them securely and review them regularly.
A key is not a feature; it is a responsibility. The moment it is generated, it needs documentation, an owner and a planned lifetime.
Key scope
Create a separate key for each integration. This lets you revoke one integration without disrupting everything else.
Storage
- Never put keys in frontend code.
- Store keys in server-side environment variables.
- Do not write tokens to logs.
- Use a secure password manager for controlled sharing.
Revocation and rotation
Revoke unused keys. For critical integrations, rotate keys periodically and disable the old one after deployment.
Kontrol listesi / Checklist
- Each integration has its own key.
- Key is stored in server-side env.
- Scope is minimal.
- Last used data is monitored.
- Unused tokens were revoked.
SSS / FAQ
Can I use an API key in the browser?
No. Public frontend code is not a safe place for API keys.
What if a key leaks?
Revoke it immediately, create a new key and update the integration.