🛡️ Security Best Practices

Credential Security

API Key

Your API token is transmitted in plain text with every request via the Authorization header. It must be treated with the same level of care as a password.

Recommendations:

• Never commit it to a version control system (Git or otherwise)
• Store it in an environment variable or a secret manager (Vault, AWS Secrets Manager, etc.)
• Never expose it on the client side (browser, mobile application)

Note

Barestho does not store your tokens in plain text: they are hashed on our end. If lost, it is impossible to recover them. You can request a new one from the Barestho team at any time, without any service interruption.

Tip

It is possible to have multiple access tokens simultaneously, which allows for rotation without downtime, for example.

---

Webhook Token

The auth_token defined during the creation of a webhook is used to verify the authenticity of incoming requests.

Recommendations:

• Store it securely, just as you would with your API key

Note

Barestho encrypts webhook tokens at rest.