API Keys
API credentials are created and managed in your Undersign account. This page covers creation, naming, secure storage and rotation.
Create an API key
In your Undersign account, open the developer settings and create an API key. The account generates a credential value that you use as your bearer token. The credential is shown once at creation, store it securely immediately.
Name your keys
Give each key a descriptive name so you can recognize where it's used, for example the environment or application it belongs to. Named keys make it easier to identify and revoke a specific key later.
Store credentials securely
Store API credentials in environment variables or a secrets manager on your server. Never expose them in browser code, public HTML, repositories, screenshots or mobile source code.
Rotate and revoke
Rotate credentials on a regular schedule and whenever you suspect exposure:
-
Create a replacement key
Generate a new key and update your application to use it.
-
Verify the new key works
Confirm an authenticated request succeeds before removing the old key.
-
Revoke the old key
Deactivate the previous key in your account once nothing depends on it.
Never log credentials. A leaked key in a log or repository is effectively a public credential. Rotate immediately if you suspect exposure.