{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","tabs","tab"]},"type":"markdown"},"seo":{"title":"Reefpay Docs","description":"Reefpay is the groundbreaking payment gateway that lets you integrate with the future of payments.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"tutorial-secure-api-keys","__idx":0},"children":["Tutorial: Secure API keys"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"why-api-key-security-matters","__idx":1},"children":["Why API key security matters"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your API key authenticates every request to Paradise Gateway. A leaked key lets anyone process transactions, access customer data, and create accounts under your client. Treat API keys with the same care as database passwords."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"threat-model","__idx":2},"children":["Threat model"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"https://files.modern-mermaid.live/images/1776278002663-mermaid-diagram-1776278002779.png","alt":"image"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rule-1-never-hard-code-keys","__idx":3},"children":["Rule 1: Never hard-code keys"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"danger","name":"Common mistake"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Never embed API keys in source code, configuration files committed to version control, or client-side JavaScript."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"bad--hard-coded-in-source","__idx":4},"children":["Bad — hard-coded in source"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"python","header":{"controls":{"copy":{}}},"source":"# DO NOT DO THIS\nAPI_KEY = \"APIKEY-01KEW32V6YNV11T33XGDR7TGWC\"\n","lang":"python"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"good--loaded-from-environment","__idx":5},"children":["Good — loaded from environment"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"python","header":{"controls":{"copy":{}}},"source":"import os\nAPI_KEY = os.environ[\"PARADISE_API_KEY\"]\n","lang":"python"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rule-2-use-environment-variables","__idx":6},"children":["Rule 2: Use environment variables"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Store API keys in environment variables. This keeps them out of your codebase and lets you use different keys per environment."]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Bash","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"export PARADISE_API_KEY=\"your-api-key-here\"\nexport PARADISE_BASE_URL=\"https://api.dev.paradisegateway.net\"\n","lang":"bash"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"PowerShell","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"powershell","header":{"controls":{"copy":{}}},"source":"$env:PARADISE_API_KEY = \"your-api-key-here\"\n$env:PARADISE_BASE_URL = \"https://api.dev.paradisegateway.net\"\n","lang":"powershell"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":".env file","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"text","header":{"controls":{"copy":{}}},"source":"PARADISE_API_KEY=your-api-key-here\nPARADISE_BASE_URL=https://api.dev.paradisegateway.net\n","lang":"text"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":".env files"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If using ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," files, add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," to your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".gitignore"]}," immediately. Never commit ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," files to version control."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"gitignore-entry","__idx":7},"children":[".gitignore entry"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"text","header":{"controls":{"copy":{}}},"source":"# API keys and secrets\n.env\n.env.*\n*.pem\n","lang":"text"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rule-3-use-a-secrets-manager-in-production","__idx":8},"children":["Rule 3: Use a secrets manager in production"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Environment variables are fine for development. In production, use a dedicated secrets manager."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Provider"},"children":["Provider"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Service"},"children":["Service"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Benefit"},"children":["Benefit"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["AWS"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secrets Manager"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Automatic rotation, IAM-based access, audit logging"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["RBAC, HSM-backed, versioned secrets"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["GCP"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret Manager"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["IAM policies, audit logging, automatic replication"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["HashiCorp"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Platform-agnostic, dynamic secrets, lease management"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"example-aws-secrets-manager","__idx":9},"children":["Example: AWS Secrets Manager"]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Python","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"python","header":{"controls":{"copy":{}}},"source":"import boto3, json\n\ndef get_api_key() -> str:\n    client = boto3.client(\"secretsmanager\", region_name=\"us-east-1\")\n    secret = client.get_secret_value(SecretId=\"paradise-gateway/api-key\")\n    return json.loads(secret[\"SecretString\"])[\"api_key\"]\n","lang":"python"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"JavaScript","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"javascript","header":{"controls":{"copy":{}}},"source":"const { SecretsManagerClient, GetSecretValueCommand } = require(\"@aws-sdk/client-secrets-manager\");\n\nasync function getApiKey() {\n  const client = new SecretsManagerClient({ region: \"us-east-1\" });\n  const resp = await client.send(\n    new GetSecretValueCommand({ SecretId: \"paradise-gateway/api-key\" })\n  );\n  return JSON.parse(resp.SecretString).api_key;\n}\n","lang":"javascript"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Go","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"package main\n\nimport (\n\t\"context\"\n\t\"encoding/json\"\n\t\"github.com/aws/aws-sdk-go-v2/config\"\n\t\"github.com/aws/aws-sdk-go-v2/service/secretsmanager\"\n)\n\nfunc getAPIKey() (string, error) {\n\tcfg, _ := config.LoadDefaultConfig(context.TODO(), config.WithRegion(\"us-east-1\"))\n\tclient := secretsmanager.NewFromConfig(cfg)\n\tout, err := client.GetSecretValue(context.TODO(), &secretsmanager.GetSecretValueInput{\n\t\tSecretId: aws.String(\"paradise-gateway/api-key\"),\n\t})\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tvar secret map[string]string\n\tjson.Unmarshal([]byte(*out.SecretString), &secret)\n\treturn secret[\"api_key\"], nil\n}\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rule-4-rotate-keys-regularly","__idx":10},"children":["Rule 4: Rotate keys regularly"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Generate new API keys periodically and when you suspect exposure."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"rotation-steps","__idx":11},"children":["Rotation steps"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"https://files.modern-mermaid.live/images/1776278044694-mermaid-diagram-1776278044885.png","alt":"image"},"children":[]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Generate a new key"]}," using ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /v1/auth/keys"]}," with Basic Authentication."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Update your secrets store"]}," with the new key."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Deploy"]}," so your application picks up the new key."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify"]}," by making a test API call."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitor"]}," for any failures from the old key (indicates something still using it)."]}]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Bash","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"curl -s -X POST \\\n  https://api.dev.paradisegateway.net/v1/auth/keys \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Basic $(echo -n 'user@example.com:password' | base64)\" \\\n  | jq -r '.key'\n","lang":"bash"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"PowerShell","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"powershell","header":{"controls":{"copy":{}}},"source":"$cred = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(\"user@example.com:password\"))\n$resp = Invoke-RestMethod -Method POST `\n  -Uri \"https://api.dev.paradisegateway.net/v1/auth/keys\" `\n  -Headers @{ \"Content-Type\" = \"application/json\"; \"Authorization\" = \"Basic $cred\" }\n$resp.key\n","lang":"powershell"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rule-5-limit-key-exposure","__idx":12},"children":["Rule 5: Limit key exposure"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Practice"},"children":["Practice"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Details"},"children":["Details"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Server-side only"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Never send your API key to a browser or mobile app"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Least privilege"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use separate keys for sandbox and production"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["One key per service"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If multiple services call the API, each should have its own key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Network restrictions"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If possible, allow API calls only from known IP ranges"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Audit access"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Monitor who has access to your secrets manager"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rule-6-detect-and-respond-to-leaks","__idx":13},"children":["Rule 6: Detect and respond to leaks"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"prevention","__idx":14},"children":["Prevention"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," and secrets files to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".gitignore"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use git hooks (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["pre-commit"]},") to scan for secrets before committing"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use tools like ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["gitleaks"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["trufflehog"]},", or GitHub's secret scanning"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"if-a-key-is-compromised","__idx":15},"children":["If a key is compromised"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Rotate immediately"]}," — generate a new key via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /v1/auth/keys"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Deploy the new key"]}," to all services."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Audit recent activity"]}," — check transaction logs for unauthorized transactions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review access"]}," — determine how the key was exposed and close the gap."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Report"]}," — if unauthorized transactions occurred, contact Paradise Gateway support with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["correlation_id"]}," values."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"danger","name":"Immediate action required"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you believe your production API key has been compromised, rotate it immediately and audit all transactions from the suspected exposure window."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"quick-reference","__idx":16},"children":["Quick reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Do"},"children":["Do"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Don't"},"children":["Don't"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Store keys in environment variables or secrets manager"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Hard-code keys in source files"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".gitignore"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Commit secrets to version control"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use different keys for sandbox and production"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Share a single key across environments"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Rotate keys on a schedule"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use the same key indefinitely"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keep keys server-side only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Expose keys in client-side code"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Log API calls (redact the key)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Log full API key values"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"further-reading","__idx":17},"children":["Further reading"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/how-tos/setup/obtain-credentials"},"children":["Obtain API credentials"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/get-started/integration-best-practices"},"children":["Integration best practices"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/concepts/security-compliance/data-protection"},"children":["Data protection"]}]}]}]},"headings":[{"value":"Tutorial: Secure API keys","id":"tutorial-secure-api-keys","depth":1},{"value":"Why API key security matters","id":"why-api-key-security-matters","depth":2},{"value":"Threat model","id":"threat-model","depth":2},{"value":"Rule 1: Never hard-code keys","id":"rule-1-never-hard-code-keys","depth":2},{"value":"Bad — hard-coded in source","id":"bad--hard-coded-in-source","depth":3},{"value":"Good — loaded from environment","id":"good--loaded-from-environment","depth":3},{"value":"Rule 2: Use environment variables","id":"rule-2-use-environment-variables","depth":2},{"value":".gitignore entry","id":"gitignore-entry","depth":3},{"value":"Rule 3: Use a secrets manager in production","id":"rule-3-use-a-secrets-manager-in-production","depth":2},{"value":"Example: AWS Secrets Manager","id":"example-aws-secrets-manager","depth":3},{"value":"Rule 4: Rotate keys regularly","id":"rule-4-rotate-keys-regularly","depth":2},{"value":"Rotation steps","id":"rotation-steps","depth":3},{"value":"Rule 5: Limit key exposure","id":"rule-5-limit-key-exposure","depth":2},{"value":"Rule 6: Detect and respond to leaks","id":"rule-6-detect-and-respond-to-leaks","depth":2},{"value":"Prevention","id":"prevention","depth":3},{"value":"If a key is compromised","id":"if-a-key-is-compromised","depth":3},{"value":"Quick reference","id":"quick-reference","depth":2},{"value":"Further reading","id":"further-reading","depth":2}],"frontmatter":{"title":"Tutorial: Secure API keys","shortTitle":"Secure API keys","intro":"Protect your Paradise Gateway API keys from exposure using environment variables, secrets managers, key rotation, and access controls.","type":"tutorial","seo":{"title":""}},"lastModified":"2026-06-05T02:46:44.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/tutorials/security/secure-api-keys","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}