API keys are sensitive account credentials. Distribution Hub's integration uses key material and signed requests according to its published authentication scheme. Keys should be stored on the server, rotated when needed and granted only the scopes required for the task; never embed production secrets in a public website or mobile client.
Key facts
- Keep secrets out of browser JavaScript
- Rotate a compromised credential immediately
- Use the narrowest permitted scope