Keep the trust boundary clear.

Build around least privilege.

Use credentials only for their intended service and permission scope. Store private keys outside client-side code. Avoid logging full request headers or responses containing personal data.

Authentication, rate limits, key rotation and resource permissions must follow the actual API contract. The documentation portal does not create, reveal or rotate customer API keys.

For a suspected security issue, use the configured Hostbip support route without including live credentials or sensitive customer information in the first message.