API key security
A SIMCOAI API key can read customer conversations and create workflow records. Treat it like a password.
Non-negotiables
- Server side only. Never put a key in browser JavaScript, a mobile app bundle, or anything a customer can view source on.
- Never commit one. Use environment variables. A key in git history is compromised even after you delete the line.
- One key per integration. So you can revoke one without breaking the others.
- Least scope. A read-only integration gets
read, notwrite.
What each scope allows
| Scope | Permits |
|---|---|
read | Listing and fetching records, and checking the key with GET /v1/me |
write | Creating and updating orders, refunds, bookings and escalations |
chat:write | Sending messages to the AI via POST /v1/chat |
If a key leaks
- Revoke it firstIn the dashboard. Revocation takes effect immediately - do this before anything else.
- Issue a replacementWith the minimum scopes that integration needs.
- Deploy the new keyThrough your secret store, not by pasting it into a config file in git.
- Check what happenedReview recent activity for anything you did not initiate.
Careful. Do not send us a live key, in a bug report or anywhere else. If you think one has leaked, revoke it first and then tell us what you saw.
Signing works the other way
Webhook signatures verify that a request genuinely came from SIMCOAI. Compare in constant time and verify against the raw body - see webhooks.