How do I keep my API keys secret?

A key acts for your account, and you pay for whatever it's used for. Treat it like a password.

Do#

• Keep keys on your server and call Clatter Labs from there.
• Store them in a secret manager, your host's secret settings, or environment variables.
• Give each integration its own key with only the permissions it needs.
• Set an expiry and rotate keys regularly.
• Revoke keys you don't use.

Don't#

• Put a key in front-end code (websites), mobile apps or browser extensions.
• Commit a key to a repository, public or private.
• Paste a key into chats, tickets, forums or AI prompts.
• Share a screenshot that shows a key.

If a key might have leaked, revoke it right away in API keys.

Learn more#

• Limits and best practices
• API keys guide
• Abuse policy

Still need help?#

• General support: support@clatterlabs.com or team@clatterlabs.xyz
• Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz

We usually reply within the first hour, and always within 24 hours. A full support team is with you.