API Key Security

Protect your Synoveo API keys to prevent unauthorized access.

API Key Structure

Each API key consists of:

• Client ID - Public identifier
• Client Secret - Private key (shown once)

Security Features

Domain Binding

API keys are bound to specific domains:

• Only requests from configured domain work
• Prevents stolen keys from working elsewhere
• Configure domain during key creation

Location Scoping

Keys can be restricted to specific locations:

• One key = one location
• Prevents accidental cross-location changes
• Limits blast radius if compromised

Rate Limiting

Built-in rate limits prevent abuse:

• Per-key limits
• Per-plan limits
• Automatic blocking on abuse

Best Practices

1. Keep Secrets Secret

• Never commit to version control
• Don't share via email/chat
• Use environment variables

// Good - environment variable
define('SYNOVEO_SECRET', getenv('SYNOVEO_CLIENT_SECRET'));

// Bad - hardcoded
define('SYNOVEO_SECRET', 'sk_live_xxx'); // NEVER DO THIS

2. Use Environment Variables

# .env file (never commit)
SYNOVEO_CLIENT_ID=your_client_id
SYNOVEO_CLIENT_SECRET=your_secret

3. Rotate Keys Regularly

• Generate new key
• Update applications
• Revoke old key
• Recommended: Every 90 days

4. Monitor Usage

• Review key usage in dashboard
• Set up alerts for unusual activity
• Check for unauthorized access

5. Revoke Compromised Keys

If a key is exposed:

1. Immediately revoke in dashboard
2. Generate new key
3. Update applications
4. Review access logs

Key Management

Creating Keys

1. Go to API Keys in dashboard
2. Click "Create API Key"
3. Configure domain and location
4. Copy and save secret immediately

Viewing Keys

• Client ID always visible
• Secret only shown once at creation
• Last used timestamp available

Revoking Keys

1. Find key in dashboard
2. Click "Revoke"
3. Confirm revocation
4. Key immediately invalidated

WordPress Plugin

The WordPress plugin handles keys automatically:

• Stored encrypted in WordPress options
• Never exposed in frontend
• Protected by WordPress security

Configure via Settings → Synoveo in WordPress admin.