Skip to main content

API Key Security - Best Practices

You are responsible for your key protection.​

Keys are directly connected to your account and accrued usage is charged at the end of each billing cycle. It is imperative to make sure active keys are stored securely on your system with access only to trusted personnel in your organization.

If you suspect your key is compromised, deactivate your key immediately and generate a new key. Please contact us online or contact your Account Manager ASAP. We can help you locate potential culprits.

IP Address Allowlisting Available

As a robust security addition, Pipl can provide an allowlist of IP addresses (also known as whitelisting). By providing your list of IPs, we can ensure that only your API keys may be used by the listed IP addresses. Simply contact us to add the IP addresses you require.

7 Quick Best Practice DO’s​

  1. DO deactivate old/unused keys.
  2. DO deactivate any key you suspect is compromised IMMEDIATELY from the API management console. Then create a new key only if needed.
  3. DO review your logs regularly for suspicious key use.
  4. DO only use secure methods to send your key such as encrypted email, encrypted documents, encrypted text messages, etc).
  5. DO use the only last four digits when communicating your key to appropriate parties. Even if you’re communicating with Pipl, please only use the last 4 characters of your key.

Best Practice DO NOT’s​

  1. DO NOT store your API key in public facing source code repositories such as public Github’s.
  2. DO NOT store your API key in phone apps, browsers or any software running outside your secure control. It can be cracked using tools such as sniffers, HTML viewers, hex viewers, etc.
  3. DO NOT send your full API key in email.
  4. DO NOT store your API key in an insecure hard drive or network resource.
  5. DO NOT reveal your key to employees or contractors who do not need to know.

Secondary Best practices DO’s:​

  1. DO use separate keys for separate functions/business units to isolate & analyze key usage.
  2. If building mobile Apps, browser apps and/or uncontrolled software, DO store your key in your network servers and force your remote app to call your server to get the Pipl API data. If the key is always on your server, it’s more secure.
  3. DO only expose your key to relevant employees/contractors. Two sets of keys can be created, one for production and one for development/other.
  4. DO make sure the admins on your Pipl account are related to your organization and are authorized to handle sensitive data.
  5. DO set quotas on your keys.
  6. DO keep a strong password on your Pipl login account. If they can hack your portal, all of your keys are exposed.
  7. DO store your keys on secure devices/servers inside your controlled network with appropriate permissions.
  8. DO draft and enforce a key storage policy within your organization.

Key Attack Vectors​

  • Insecure network handling, lack of HTTPS or using GET for API calls.
  • Clear text reveal via email or insecure document handling.
  • Poor application design which reveals your keys over TCP/IP such as phone app or browser.
  • Employees or contractors leaking keys.