Rules worth holding to
Server-side only
Server-side only
Never put a key in a browser bundle, a mobile app, or anything else you ship to a user. Anything shipped to a device can be read off it. If your frontend needs to trigger a post, call your own backend and let it hold the key.
One key per environment
One key per environment
Separate keys for production, staging and local development. Then revoking a leaked staging key does not take production down with it, and Last used tells you something real.
In a secret manager, not in the repository
In a secret manager, not in the repository
Environment variables loaded from a secret manager. Not committed config, not a
.env in the repository, not a Slack message.Never in a URL
Never in a URL
Send the key in the
Authorization header. Keys in query strings end up in proxy logs, browser history and referrer headers.Rotating a key
Nylon keys have no expiry, so rotation is something you do rather than something that happens to you. Rotate on a schedule, and immediately whenever someone with access to a key leaves.1
Create the replacement
Make a new key with a name that distinguishes it from the one it replaces.
2
Deploy it
Roll it out everywhere the old one was used.
3
Confirm the old key has gone quiet
Check Last used on the API page, and filter the request logs to be sure nothing is still calling with it.
4
Revoke the old key
Only then. Revoking is immediate and cannot be undone.
If a key leaks
Revoke it first and ask questions second — a revoked key cannot do any more harm, and creating a replacement takes seconds. Then use the request logs to see what was done with it. Filter by time range and look for requests you cannot account for: posts published to accounts you did not expect, or traffic from outside your usual pattern.Signing secrets are separate
Webhook signing secrets are a different credential with a different job: an API key authenticates you to Nylon, a signing secret proves a webhook came from Nylon. Rotating one does not affect the other.Webhook deliveries and failures
Rotating a signing secret, and why there is no overlap window.
Related
API keys
Creating and revoking keys.
What Nylon stores
How keys and social credentials are held.