Keep X-API-Key behind your backend

A ChainsFlow API key authorizes every portfolio owned by its API account. Never embed it in Angular, React, mobile binaries or downloadable examples. Browser code should call a narrow same-origin BFF, which checks its local user-to-portfolio mapping before forwarding a portfolioId.

Use a secret manager and separate environments

Store the raw key in a deployment secret manager or protected environment variable, not source control, a database content field or CI logs. Create a different key for local, staging and production environments. ChainsFlow API stores only a SHA-256 hash and short suffix, so the raw value cannot be recovered from its database after the one-time creation response.

Rotate without an avoidable outage

Create a replacement key, deploy it to all instances, verify traffic and only then revoke the previous key. During a rolling deployment, both keys may need to remain valid briefly. Track key IDs or suffixes in safe metrics so operators can see which deployment still uses the old credential without ever logging the full secret.

Redact headers, payload secrets and provider credentials

HTTP access logs, reverse proxies, APM agents and exception reporters can capture request headers by default. Explicitly redact X-API-Key, exchange apiKey, apiSecret and passphrase fields. Correlation IDs, operation names, status codes, credit cost and latency are sufficient for most diagnostics and carry much less security risk.

Make revocation the first incident action

If a key may be exposed, revoke it in the developer dashboard, issue a replacement and inspect usage for unexpected portfolio operations. Rotation does not revoke exchange credentials because those belong to individual connections. Preserve only the minimal evidence required by your incident policy.