Why API security matters
API credentials can provide access to sensitive business functionality. Anyone who obtains secret credentials may be able to make unauthorized API requests.
Never expose secret credentials
Do not place secret API credentials inside public repositories, frontend JavaScript, HTML pages, mobile application packages or publicly accessible configuration files.
Use environment variables
Store sensitive configuration securely using your server environment or an appropriate secrets-management system.
Restrict access
Only authorized developers and systems should have access to production credentials.
Use separate environments
Keep development and production credentials separate whenever the available PassCash integration environment supports this approach.
Respond to suspected compromise
If you believe credentials have been exposed, stop using the affected credentials and contact the appropriate PassCash team for assistance with securing the integration.