DomainToolBelt
Sign up

Learn

Keep your API key safe

Your key works like a password for your account's API credits. Here is how to store it, how we spot a leak, and how to report one.

Store it on the server

  • Keep the key in an environment variable or a secrets manager, never in code you commit.
  • Call the API from your server. A key in a browser page or a mobile app can be read by anyone who opens it.
  • Use one key per app, with a clear name, so you can delete one without breaking the others.
Keep the key in the environment
# .env (add .env to .gitignore)
DTB_API_KEY=dtb_live_...

# Node.js
const key = process.env.DTB_API_KEY

# Python
key = os.environ["DTB_API_KEY"]

Rotate, expire, read only

  • Rotate a key in API keys to get a new one. The old key keeps working for 24 hours, so you can update your apps without downtime.
  • Expiry: a new key can expire after 30 days, 90 days or 1 year. After that, calls answer invalid_key.
  • Read only keys can look things up but cannot change alerts or the webhook. Use them for dashboards and reports.

What a key looks like

Keys start with dtb_live_ followed by 32 letters and digits. We store only a fingerprint of the key, so we can never show it again. You see it once, when you create it.

What we watch for

  • Public code on GitHub. GitHub scans public code for our key format and tells us when it finds one. We check the key and revoke it at once if it is live, then email you.
  • Unusual use. We flag a key that is suddenly used from many countries or far more than usual, and look at it.
  • Reports. Anyone can report a leaked key with the form below.

You get an email when a key is created on your account and when we revoke one. You can see when each key was last used in your dashboard.

If your key leaked

  1. Delete the key in API keys. It stops working on every server at once.
  2. Create a new key and put it in your apps.
  3. Remove the old key from the code or page where it leaked. Deleting a commit does not remove it from history, so the delete in step 1 is what matters.

Report a leaked key

Found a DomainToolBelt key somewhere public? Paste it below, or tell us where you saw it. If you paste a full live key we revoke it straight away and tell its owner. We never keep the full key.