Where should I store my API keys?

Good places:

• A secret manager or vault your company uses.
• Your hosting or CI platform's secret settings (sometimes called "secrets" or "environment variables").
• A local .env file for development only, listed in .gitignore.
• A password manager, to keep a copy you can find later.

Bad places:

• Source code (const key = "clsk_...").
• Shared documents, spreadsheets or chat messages.
• Front-end code or mobile apps, where anyone can read them.

Read keys from the environment at runtime, as in the docs examples (CLATTER_API_KEY, CLATTER_ACCOUNT_ID).

Good to know#

• Give each integration its own key with only the permissions it needs.
• If a key may have leaked, revoke it first, then replace it.

Learn more#

• Limits and best practices
• API keys guide
• Abuse policy

Still need help?#

• General support: support@clatterlabs.com or team@clatterlabs.xyz
• Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz

We usually reply within the first hour, and always within 24 hours. A full support team is with you.