Security
Authentication
ThreatPrevent authenticates requests using API keys in the HTTP header.
HTTP header
x-api-key: tp_xxxxxxxxxxxxxxxxxxxxxxxxxAPI key handling
Keep keys server-side
Do not embed a secret API key in public JavaScript, browser extensions distributed to third parties, or public repositories.
Use environment variables
Store production keys in a secret store or server environment rather than directly in application source code.
Rotate on exposure
If a key may have been disclosed, disable it and issue a replacement.
Separate systems
Where practical, use distinct API keys for different integrations so usage and compromise can be isolated.
Treat API keys as passwords.
Anyone who holds a valid key can consume your account's API usage until the key is disabled.