Skip to main content

Security good practices

Here are some techniques which will help you minimise the risk of leaked credentials and unauthorised access to your data.

Safekeeping private key​

To prove the possession of a private key you don't have to present the key itself. This gives much greater security: unlike a shared secret, your credential never leaves your premises. Here are a few steps to ensure that:

  • private key should never be logged, added to URLs or displayed in any other way.
  • access to the private key should be limited.
  • ideally the service using the private key should not have the actual private key (so it's never present in its RAM). Instead it should ask a dedicated service to sign arbitrary data using the securely stored private key.

If there's even the slightest suspicion that the private key might have leaked - revoke the corresponding certificate immediately using the Web UI (or do a rotation to avoid downtime).

Safekeeping an access token​

Same safekeeping rules apply. Don't log it, include it in URLs, or display it anywhere.