Help CenterAccount & Security

Protect API keys, postback secrets and webhook secrets

Security rules for credentials that can read inventory or authenticate money-related callbacks.

Treat them like passwords

API keys, network postback keys, campaign postback secrets and webhook signing secrets should never be pasted into public pages, client-side code or public repositories.

Rotate after exposure

If a secret appears in logs, screenshots, support messages or source control accessible to others, replace it and update the integration.

Least exposure

Keep provider credentials in encrypted platform settings and use server-side integrations whenever possible.

Still need help?Open a support ticket for account/platform issues or Offer Support for a missing-credit investigation.

Support Offer Support