Your API key grants full access to this account's candidate data. The product says so on the integrations page, and it is worth taking literally: anyone holding the key and secret can read every candidate you have ever assessed, including their names, email addresses and results.
Where your key should live
- In a secrets manager, or in your platform's environment variables.
- Read by server-side code only.
Where your key should never live
- Not in front-end code. Anything in a browser is public, and a key in JavaScript is a key you have published.
- Not in a repository, including a private one. Private repositories get forked, cloned and backed up.
- Not in a chat message, a ticket or an email. Those are searchable forever by everyone in your company.
- Not in a spreadsheet of credentials.
- Not with an agency or contractor who only needs results. Send them an export instead.
Who on your team can see the key
Everyone. There is no separate developer or admin role, so every team member can reveal and regenerate the key. Team membership is the access control. See what your team can see.
That makes removing leavers promptly part of your key hygiene, not just your account hygiene.
If your key has leaked
Regenerate it, immediately, from the integrations page.
The old key and secret stop working the moment you confirm. There is no grace period, which is the right behaviour for a leak and means you should plan the switchover for anything that is still legitimately using it.
Then update every system that held the old one. If you are not sure how many there are, that is itself a reason to regenerate.
Rotating your key routinely
Worth doing when someone with access leaves, when a contract ends, and after any incident in a system that held it. There is no expiry on the key, so nothing forces the habit.
What the key cannot do
The key is read-only. Someone holding it cannot create assessments, invite candidates, spend your balance or change your settings. That limits the damage of a leak to disclosure, which is still serious: candidate personal data belongs to real people and losing it is a reportable event in many jurisdictions.
Webhook secrets too
The same applies to your webhook signing secret. See webhooks.