Security checklist
Protect workspace API keys and customer data throughout an integration.
- Keep API key server-side.
- Use HTTPS only.
- Never put key in URL or query string.
- Never embed key in frontend bundle or mobile application.
- Never persist key in browser storage.
- Never include key in logs, screenshots, or source control.
- Restrict secret-manager access.
- Regenerate immediately after suspected exposure.
- Remember regeneration stops old integration immediately.
- Treat recordings, summaries, prospects, activities, users, and metrics as customer data.
ReadMe Try It is intended only for temporary manual testing on trusted device. Requests go directly to Sonik, but key is still entered into browser page. Clear authentication field and close or reload page when finished.
Updated 9 days ago
Did this page help you?