API Key Security

API Key Basics

API keys authenticate your application with Document Stack. They are equivalent to passwords — anyone with your API key can generate documents and access resources in your organization.

Secure Storage

Store API keys securely using environment variables or secret management services:

DOCUMENTSTACK_API_KEY=ds_live_abc123...

const apiKey = process.env.DOCUMENTSTACK_API_KEY;

if (!apiKey) {
    throw new Error("DOCUMENTSTACK_API_KEY is not set");
}

• Environment variables — Use .env files locally; set via platform UI in production
• Secret managers — AWS Secrets Manager, Google Secret Manager, Azure Key Vault, HashiCorp Vault
• CI/CD secrets — GitHub Actions secrets, GitLab CI variables, Vercel environment variables

Prevent Accidental Commits

Always add .env files to .gitignore:

# Environment variables
.env
.env.local
.env.production
.env*.local

Key Rotation

Regularly rotate API keys to limit exposure:

1. Create a new API key in the dashboard
2. Update your application to use the new key
3. Verify the new key works in production
4. Delete the old key from the dashboard

We recommend rotating keys at least every 90 days, and immediately if you suspect a key has been compromised.

Multiple Keys

Create separate keys for different environments and services:

What to Never Do

• ❌ Hard-code keys in source code
• ❌ Include keys in client-side JavaScript or mobile apps
• ❌ Share keys via email, Slack, or chat
• ❌ Use the same key across all environments
• ❌ Log API keys in application logs
• ❌ Include keys in error messages or stack traces

If a Key Is Compromised

1. Delete the key immediately — Go to the dashboard and remove the compromised key
2. Create a new key — Generate a fresh key
3. Update your application — Deploy with the new key
4. Audit usage — Check audit logs for unauthorized activity
5. Investigate — Determine how the key was exposed and fix the root cause

Server-Side Only

API keys must only be used in server-side code. Never expose them in:

• Browser JavaScript (React, Vue, Angular client code)
• Mobile applications
• Public repositories
• API documentation examples with real keys

If you need to generate PDFs from a client application, route requests through your own backend server that holds the API key.

Next Steps

• API Keys — Create and manage keys
• Security Overview — Full security documentation
• Audit Logging — Track key usage