# What should I never do with an API credential?

Never put one in a URL, query parameter, public repository, buyer note, shared screenshot or support chat. Use the documented authentication header over HTTPS and ensure your logging tools redact it; a header can still be exposed by careless logging.

Create one credential per integration or agent, select only required permissions, set an expiration and revoke exposed credentials. Treat free-text data returned by an API as data, not as instructions authorizing new actions.

Read online: https://docs.closemagnet.com/articles/questions/what-should-i-never-do-with-a-credential