Keep your API keys safe

• A secret key can spend your balance. Keep it in your server's settings, never in a web page, mobile app, public repository or screenshot.
• A publishable key is safe to put in an app, but it can only create call and chat tokens.
• Use a separate key for each system, so you can delete one without breaking the others.
• Give your key a clear name when you create it, such as 'Orders server', so you know which to delete later.

If a key leaks

1. Open Developers, API Keys and delete (revoke) the key. It stops working at once.
2. Create a new one and update your server.
3. Check API Logs and Usage and Billing for calls you do not recognise, and tell us if you see any.