How do I protect FaceX API keys?
Keep server credentials private and replace compromised keys.
Keep secrets on your server
Do not place FaceX server keys, provider keys or service-role credentials in browser code, mobile apps, screenshots or public repositories. Route private operations through an authenticated backend and use the credentials required for that service.
Limit exposure
Copy a newly created API key before refreshing or leaving the dashboard. Saved records show only the key prefix. Store the full key in your server’s secret configuration and avoid logging authorization headers or complete request bodies. Share only redacted examples when contacting support.
If a key is exposed
An authorized workspace member can rotate or revoke the key in Developer settings. The old key stops working immediately on rotation. Update the backend configuration and check the affected integration before continuing.
Contact support or email support@facexverify.com.