> For the complete documentation index, see [llms.txt](https://knowledgebase.fabricdata.com/studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.fabricdata.com/studio/integrations-and-apis/api-overview/security-best-practices.md).

# Security Best Practices

Origin Studio API keys provide access to your tenant data. They should be treated as sensitive credentials.

Failure to properly secure API keys may result in unauthorized access to your content metadata and workflows.

***

### Protect Your API Keys

#### Keep API Keys Secure

API keys should be treated like passwords.

Never expose API keys in:

* Frontend or client-side code (e.g., browser JavaScript, mobile apps)
* Public repositories (e.g., GitHub, GitLab, Bitbucket)
* Shared documentation or screenshots
* Log files
* Email or messaging platforms

API keys must only be used in secure server-side environments.

***

### Use Secure Storage

Store API keys securely using trusted secret management solutions.

Recommended storage methods:

* Secrets manager (e.g., AWS Secrets Manager, Azure Key Vault, Google Secret Manager)
* Environment variables on secure servers
* Encrypted configuration stores

Avoid:

* Hardcoding keys directly in source code
* Storing keys in plaintext configuration files
* Sharing keys across multiple services unnecessarily

***

### Rotate API Keys Regularly

To reduce risk:

* Rotate API keys periodically
* Immediately revoke and regenerate keys if compromised
* Remove unused or legacy keys

As a best practice:

* Issue separate API keys per integration
* Avoid reusing the same key across multiple systems

This improves traceability and limits blast radius if one key is compromised.

***

### Apply Principle of Least Privilege

Where possible:

* Assign API keys only the permissions required
* Avoid granting administrative access unless necessary
* Separate production and staging credentials

Limiting access reduces the impact of potential credential exposure.

***

### Secure Transport

* All API requests must use HTTPS
* Do not send API keys over unsecured HTTP connections
* Ensure TLS certificates are valid and up to date

Origin Studio rejects unsecured connections.

***

### Protect Webhook Endpoints (SNS)

If using Events & Webhooks:

* Validate SNS message signatures
* Verify the `TopicArn` matches your expected tenant
* Restrict inbound traffic to known AWS SNS IP ranges where possible
* Implement idempotency handling to prevent replay issues

Your webhook endpoint should:

* Respond quickly with HTTP 200
* Reject malformed or unexpected payloads

***

### Monitor & Audit Usage

Regularly:

* Monitor API usage patterns
* Investigate unusual traffic spikes
* Audit active API keys
* Remove keys that are no longer in use

Unexpected activity may indicate key exposure.

***

### Incident Response

If you suspect an API key has been compromised:

1. Immediately revoke the affected key
2. Generate a new key
3. Update all dependent systems
4. Review logs for suspicious activity

Contact Fabric Support if further investigation is required.