API Security
Key storageStore keys in a secret manager or environment variables ($RAIPA_API_KEY) — never in source control, client-side JavaScript, mobile app bundles or logs.
Reveal onceThe full key value is shown exactly once at creation. RAIPA stores only a hash; a lost secret cannot be recovered — rotate instead.
RotationRotate on a schedule and on personnel change. Rotation issues a new secret (shown once) and expires the previous one after a grace window, so deployments can switch without downtime.
RevocationRevoke immediately terminates a key. Use it when a key may be exposed; revocation cannot be undone.
Browser exposureNever call the RAIPA API directly from a browser or ship a key in frontend code. Route requests through your own server, which holds the key.
CI/CDUse your CI provider’s encrypted secrets (masked in logs). Prefer a dedicated key per pipeline with the CI environment label, so it can be rotated independently.
Compromised key procedure1. Revoke the key. 2. Create a replacement. 3. Update deployments/CI. 4. Review Usage for unexpected traffic. 5. Contact support with the request IDs if you see abuse.
RAIPA never asks for your API key by email. Requests are authenticated with the Authorization header over TLS only.