Skip to main content
SignupBear has two key environments:

​
Store keys safely

  • Keep keys in a server-side secret manager.
  • Never commit keys to source control.
  • Never expose keys through NEXT_PUBLIC_ or another browser-visible variable.
  • Never write the full Authorization header to logs.
The raw key is shown once. SignupBear stores only a SHA-256 hash for authentication and a short prefix for identification.

​
Rotate a key

  1. Create a replacement key in the same environment.
  2. Add it to your deployment secret manager.
  3. Deploy and verify a test request.
  4. Revoke the old key in Dashboard > API keys.
Revocation takes effect on the next request and cannot be undone. Keep the old key active until the replacement deployment is verified.