Keeping keys safe

Call the API from your server only - no keys in web pages or URLs, no cookies, no CORS - and what the API does on its side.

• Server side only. A key in a web page or a mobile app is a published key. The API sends no CORS headers (browsers cannot call it) and the stream refuses browser origins.
• Header only. Send the key in Authorization: Bearer .... Keys in a query string are refused.
• No cookies. Being signed in to ChartDeck in the same browser grants nothing: API calls authenticate by key alone.
• Least scope. Give each key only the scopes its program needs, and an IP allow list when your servers have fixed addresses.
• Secret store. Keep keys in an environment variable or your platform's secret manager, never in source control.

On ChartDeck's side, keys are stored as fingerprints (never the key itself), compared in constant time, and never written to logs. Repeated failed keys from one address are refused for a while (429 rate_limited).

The API is read-only: no route can place an order, move money or change an account.