API keys and webhooks
If the API is open for you, create one key per tool and receive order events on an https address.
The key is shown only once: copy it right away and keep it in a secrets manager, never in a message or public code.
A lost or exposed key is revoked immediately and a new one created. A webhook's signing secret is also shown only once.
In the same topic
Need a personal answer?
Write to the team. Never share a password or card number.