Skip to main content

API key security best practices

How to store the organization API key, why it must never be shared, and what happens when you rotate it.

Written by Romain Morvant

The organization API key is shown once when you create it. Anyone who has it can present learner identity to your widget embed. Keep it as a secret for the whole organization.

Store it as soon as it appears

Copy the key immediately, then put it in a password manager or another store your organization controls. After you close that window, Raison only shows a mask. It will not display the full key again.

The Integrations settings in Organization, focused on the API section. The section explains API access and shows an API Key row with the key masked as dots.

Never share it

  • Do not put the key in a ticket, a chat, or an email to support.

  • Support cannot recover a key from a message. If it may have leaked, replace it.

  • The key appears in page HTML inside data-user, so only put the widget on pages you control.

Replace the key when you need to

Raison keeps one organization API key. You cannot create a second key while one exists. To rotate, open Organization, then Integrations, go to API, delete the current key, then create a new one.

The old key stops working as soon as you delete it. There is no overlap, so every page using the old key breaks until you update it. Update the embed snippets at the same time.

Related

Need help? Write to [email protected].

Did this answer your question?