> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nylon.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Keep keys secure

> Where Nylon API keys belong, how to rotate them, and what to do if one leaks.

A Nylon API key can publish to every social account your organization has connected. Treat it the way you treat a database password.

## Rules worth holding to

<AccordionGroup>
  <Accordion title="Server-side only" icon="server">
    Never put a key in a browser bundle, a mobile app, or anything else you ship to a user. Anything shipped to a device can be read off it. If your frontend needs to trigger a post, call your own backend and let it hold the key.
  </Accordion>

  <Accordion title="One key per environment" icon="layers">
    Separate keys for production, staging and local development. Then revoking a leaked staging key does not take production down with it, and **Last used** tells you something real.
  </Accordion>

  <Accordion title="In a secret manager, not in the repository" icon="lock">
    Environment variables loaded from a secret manager. Not committed config, not a `.env` in the repository, not a Slack message.
  </Accordion>

  <Accordion title="Never in a URL" icon="link">
    Send the key in the `Authorization` header. Keys in query strings end up in proxy logs, browser history and referrer headers.
  </Accordion>
</AccordionGroup>

## Rotating a key

Nylon keys have no expiry, so rotation is something you do rather than something that happens to you. Rotate on a schedule, and immediately whenever someone with access to a key leaves.

<Steps>
  <Step title="Create the replacement">
    Make a new key with a name that distinguishes it from the one it replaces.
  </Step>

  <Step title="Deploy it">
    Roll it out everywhere the old one was used.
  </Step>

  <Step title="Confirm the old key has gone quiet">
    Check **Last used** on the API page, and filter the [request logs](/help/request-logs) to be sure nothing is still calling with it.
  </Step>

  <Step title="Revoke the old key">
    Only then. Revoking is immediate and cannot be undone.
  </Step>
</Steps>

## If a key leaks

Revoke it first and ask questions second — a revoked key cannot do any more harm, and creating a replacement takes seconds.

Then use the [request logs](/help/request-logs) to see what was done with it. Filter by time range and look for requests you cannot account for: posts published to accounts you did not expect, or traffic from outside your usual pattern.

## Signing secrets are separate

Webhook signing secrets are a different credential with a different job: an API key authenticates *you to Nylon*, a signing secret proves *a webhook came from Nylon*. Rotating one does not affect the other.

<Card title="Webhook deliveries and failures" icon="webhook" href="/help/webhook-deliveries-and-failures">
  Rotating a signing secret, and why there is no overlap window.
</Card>

## Related

<Columns cols={2}>
  <Card title="API keys" icon="key" href="/help/api-keys">
    Creating and revoking keys.
  </Card>

  <Card title="What Nylon stores" icon="database" href="/help/data-and-security">
    How keys and social credentials are held.
  </Card>
</Columns>