How do I keep API credentials secure in my automations?

Never paste raw credentials

Don't put API keys directly in workflow steps where they're visible. Use the platform's built-in credential storage instead. Most platforms have a "connections" or "secrets" section designed for this.

Use environment variables

Set credentials as environment variables or secrets in your platform. Reference them by name in workflows, not their actual values. This keeps keys out of logs and exports.

Rotate keys regularly

Regularly generate new API keys and delete old ones. If a key is exposed, an attacker can only use it temporarily. Check if your services let you set expiration dates on tokens.

Limit key permissions

If the service allows, create API keys with minimal necessary permissions. Don't use master keys. A read-only key for pulling data is safer than a key that can delete.

Audit access

Check logs showing which credentials were used when. Some platforms show this. If credentials were accessed from unexpected locations, regenerate them.

Don't share workflows with credentials visible

When exporting or sharing a workflow definition, ensure credentials aren't included. The platform should strip them automatically, but verify.