Security

Integration checklist

An API key is a password for the scopes it carries. Design storage, rotation, logging, and failure handling before issuing production credentials.

Phylex never needs your raw API key in a support ticket. Revoke and replace a key immediately if it appears in client code, logs, screenshots, or a repository.

Store keys in a server-side secret manager, never browser code, mobile bundles, logs, analytics, or Git.
Grant the narrowest scopes and restrict production keys to fixed egress CIDRs where possible.
Set an expiry, rotate before it, and revoke the old key after consumers move.
Keep services:write and services:power on separate, short-lived keys.
Grant finance:read only to server-side integrations that need billing history.
Persist one Idempotency-Key per logical mutation until the final response is durable.
Treat a 404 as opaque; never infer whether another tenant owns the reference.
Reseller write scopes are permanently bound to the issuing reseller tenant.

Manage account keys Account OpenAPI specification