API

API token safety

Treat API tokens like passwords. Store them server-side, scope access, rotate exposed tokens and never place them in public code.