Keep an API key safe, and revoke one

Anyone who has one of your API keys can use your account through the API and, if the key may Make things and spend credits, spend your credits.

Where a key belongs

• On your server. Keep it in your server's environment or secrets store, and call Vessero from there.
• Never in a web page or an app people download. Anything that runs on someone else's device can be read. A mobile app should call your own server, and your server calls Vessero.
• One key for each place. Use one for your live server, one for testing, one for each automation. Then revoking one stops only that one.
• Only what it needs. A key that only reads your account can't spend anything.
• A daily cap limits what one key can spend in a day. See What API calls cost, and how to cap them.

Vessero keeps only a fingerprint of each key, never the key itself, so nobody at Vessero can read it back to you. If you lose one, make a new one.

Revoke a key

Open Settings → API, press the key and press Revoke. Every call holding it is refused from then on, and webhooks for its runs stop. Work it already started still finishes, and what it made stays in your Library. A revoked key can't be turned back on: make a new one, and put it where the old one was.

You can hold up to 20 keys at once. Revoked keys don't count.