Security
API keys
Protect the long-lived key bound to your Domain0 application.
- Store keys only in a server secret manager or encrypted deployment variable.
- Never use a public frontend environment prefix.
- Never send a platform key through the connection bridge.
- Create separate keys for production, staging, and local development.
- Revoke keys that are unused, exposed, or owned by departed operators.
- Treat the one-time value as a password; the dashboard cannot recover it.
The SDK validates key shape before a request. The hosted API derives ownership from the verified key and ignores caller-supplied application or tenant IDs.