How do I protect my credentials?
- Never expose keys client-side. Do not put the key or app password in browser code, mobile apps or public repositories. Call the API from your backend.
- Store both in environment variables or a secret manager, and keep them out of logs.
- Create a separate key and app password per system, with a clear name, so you can revoke one without affecting others.
How do I rotate keys?
Create a new key and app password, deploy them, confirm traffic works, then revoke the old ones in Settings. Revoked credentials stop working immediately. Set an expiry on app passwords where possible, and rotate on a schedule or whenever someone with access leaves.
Can I restrict where requests come from?
Yes. An app password can have an IP allow-list. Requests with that app password from any other address are rejected with 403 forbidden. Use it when your server has a fixed outbound IP.
How do I make integrations reliable?
- Send an Idempotency-Key on every send.
- Honor
Retry-Afteron 429, and back off with jitter on 5xx. - Log the
request_idof failures so support can trace them. - Always send a plain-text body alongside HTML.
- Set client timeouts (for example 30 seconds).