Secure Signaliz and rotate credentials
Use a unique, minimally scoped credential for each person, environment, AI client, and production service.
Security checklist
Keep API keys and private keyed MCP URLs out of browser code, source control, screenshots, tickets, and chat.
Store production secrets in a server-side secret manager.
Use separate keys for development, production, CI, and desktop clients.
Review the workspace key inventory and revoke unused credentials.
Limit team membership and key scopes to the work required.
Authenticate webhooks and log delivery IDs.
Preserve run and billing receipts without storing unnecessary personal data.
Rotate without downtime
Create a replacement key with the same necessary scopes.
Update one client or environment.
Confirm workspace identity and run a read or dry-run test.
Update remaining intended clients.
Revoke the old key.
Watch activity and error receipts for unexpected use.
If a secret may have been exposed, revoke it first, then investigate. Do not wait for proof of misuse. A revoked key cannot resume new calls; preserve completed job IDs and results before rotation when operationally necessary.