Store keys as secrets
- Use a deployment platform or cloud secret manager.
- Never place a Taiega key in browser JavaScript, a mobile binary, source control, screenshots, or support messages.
- Use separate keys for development, staging, and production.
- Restrict who can read and rotate production credentials.
Authenticate requests
Send the key only to the documented Taiega API origin using HTTPS and the required authorization header. Validate response status and request identifiers without logging the full credential.
Rotate without downtime
Create a replacement key with the same minimum permissions, deploy it, verify successful traffic, then disable and revoke the old key. If exposure is suspected, disable the key immediately and investigate its recent usage.