# Keep your API key safe

> Store Ur Next Door API keys in environment variables, never in browser code or shared GPTs, use narrow scopes and expiry, rotate them, and revoke a leaked key.

Source: https://docs.urnextdoor.com/security/

Your API key can publish under your name. Treat it like a password.

## The rules

1. **Keep it in an environment variable** (`UND_API_KEY`) or your tool's secret store. Never write it into source code, prompts, documents or chat messages.
2. **Never put it in browser code.** The API sends no CORS headers, so browsers refuse to call it from a web page anyway, and a key in a page can be read by anyone who opens it. Call the API from servers, scripts, CLIs and agents.
3. **Never put it in a URL.** Keys in query strings end up in logs and histories; the API does not accept them.
4. **Never share a GPT, Zap or workflow that holds your key** with people who should not post as you. In a ChatGPT custom GPT, the key is used for every conversation, so keep the GPT set to **Only me**.
5. **Never commit it.** Add `.env` to `.gitignore` before you create the file.
6. **One key per tool, with narrow scopes and an expiry.** A Zapier flow that only posts needs only `content`. Prefer 30 or 90 day expiry over never.
7. **Never send it to support.** Nobody at Ur Next Door will ask for your key. Share the `request_id` instead.

## Rotate a key

Do this every few months, or when someone who had access leaves:

1. Create a new key with the same scopes in **Settings > API keys**.
2. Put the new key in `UND_API_KEY` (or the tool's secret store).
3. Check it with `GET /api/v1/me`.
4. Revoke the old key.

## If a key leaks

1. **Revoke it now** in **Settings > API keys** on the website or in the app. It stops working immediately.
2. **Check what it did.** Look at **Recent requests** on the same tab and filter [Settings > Analytics](https://docs.urnextdoor.com/analytics.md) by that key. Delete anything you did not publish.
3. **Create a new key** for the tool and update it.
4. If the key was committed to a repository, revoke it first, then remove it from the history. Assume a pushed key was seen, even if the repository is private.

If you think your account itself is at risk, reset your password: that also revokes **all** your keys.

## Keys are easy to scan for

Every key starts with `und_sk_` and ends with a 6 character checksum, 56 characters in all. That makes accidental leaks easy to find with a secret scanner. For example, a custom rule for tools such as gitleaks or trufflehog can match:

```text
und_sk_[A-Za-z0-9]{49}
```

The checksum lets a scanner tell a real key from random text that happens to start with `und_sk_`.

## What Ur Next Door stores

- **Your key:** only a fingerprint (a SHA-256 hash), plus the first 12 and last 4 characters for display. The full key is shown once, when you create it, and cannot be recovered.
- **An email to you** whenever a new key is created on your account.
- **A request log** for each API call: time, method, route pattern, status, error code, which key, a short client label and the duration. It does not store your IP address, your user agent or request bodies. Answers kept for idempotent replays are deleted after 24 hours. Request log entries are kept for 30 days.
- **An activity log** of what you did (for example "created a post"), from every source: website, app and API. It is kept for 400 days and powers [API analytics](https://docs.urnextdoor.com/analytics.md). Everything is deleted with your account.

## When keys stop working on their own

- When they expire.
- When you reset your password: all keys are revoked.
- While your account is suspended. If it is reinstated, keys that were not revoked work again.

## Report a security problem

If you find a vulnerability in the API or these docs, email support@urnextdoor.com with the details. Do not include a working key.

## Next steps

- [Create an API key](https://docs.urnextdoor.com/getting-started/create-api-key.md).
- [Scopes](https://docs.urnextdoor.com/getting-started/scopes.md).
- [API analytics](https://docs.urnextdoor.com/analytics.md).