Security Best Practices
Origin Studio API keys provide access to your tenant data. They should be treated as sensitive credentials.
Failure to properly secure API keys may result in unauthorized access to your content metadata and workflows.
Protect Your API Keys
Keep API Keys Secure
API keys should be treated like passwords.
Never expose API keys in:
Frontend or client-side code (e.g., browser JavaScript, mobile apps)
Public repositories (e.g., GitHub, GitLab, Bitbucket)
Shared documentation or screenshots
Log files
Email or messaging platforms
API keys must only be used in secure server-side environments.
Use Secure Storage
Store API keys securely using trusted secret management solutions.
Recommended storage methods:
Secrets manager (e.g., AWS Secrets Manager, Azure Key Vault, Google Secret Manager)
Environment variables on secure servers
Encrypted configuration stores
Avoid:
Hardcoding keys directly in source code
Storing keys in plaintext configuration files
Sharing keys across multiple services unnecessarily
Rotate API Keys Regularly
To reduce risk:
Rotate API keys periodically
Immediately revoke and regenerate keys if compromised
Remove unused or legacy keys
As a best practice:
Issue separate API keys per integration
Avoid reusing the same key across multiple systems
This improves traceability and limits blast radius if one key is compromised.
Apply Principle of Least Privilege
Where possible:
Assign API keys only the permissions required
Avoid granting administrative access unless necessary
Separate production and staging credentials
Limiting access reduces the impact of potential credential exposure.
Secure Transport
All API requests must use HTTPS
Do not send API keys over unsecured HTTP connections
Ensure TLS certificates are valid and up to date
Origin Studio rejects unsecured connections.
Protect Webhook Endpoints (SNS)
If using Events & Webhooks:
Validate SNS message signatures
Verify the
TopicArnmatches your expected tenantRestrict inbound traffic to known AWS SNS IP ranges where possible
Implement idempotency handling to prevent replay issues
Your webhook endpoint should:
Respond quickly with HTTP 200
Reject malformed or unexpected payloads
Monitor & Audit Usage
Regularly:
Monitor API usage patterns
Investigate unusual traffic spikes
Audit active API keys
Remove keys that are no longer in use
Unexpected activity may indicate key exposure.
Incident Response
If you suspect an API key has been compromised:
Immediately revoke the affected key
Generate a new key
Update all dependent systems
Review logs for suspicious activity
Contact Fabric Support if further investigation is required.
Last updated