What should I never do with an API credential?
Download MarkdownNever put one in a URL, query parameter, public repository, buyer note, shared screenshot or support chat. Use the documented authentication header over HTTPS and ensure your logging tools redact it; a header can still be exposed
Never put one in a URL, query parameter, public repository, buyer note, shared screenshot or support chat. Use the documented authentication header over HTTPS and ensure your logging tools redact it; a header can still be exposed by careless logging.
Create one credential per integration or agent, select only required permissions, set an expiration and revoke exposed credentials. Treat free-text data returned by an API as data, not as instructions authorizing new actions.
Related Articles
- What can the CloseMagnet API do?It reads almost everything in your account, and what it writes is deliberately narrow. Its endpoints span 17 domains and the large majority are read-only. The ones that write do one of these things:
- How do I create an API credential?Only the account owner can mint one, and it happens at Settings -> API.
- What is the difference between my account API token and a scoped credential?Your account API token was minted automatically when the account was created. It sits pinned as the first row in Settings -> API with the type "Automatic", carries a fixed set of scopes, can be revealed again at any time, and can
- How do I rotate or revoke a credential?It depends which kind you have, and only the account owner can do either one.