Store server-side keys
Keep secret credentials and webhook secrets out of browsers, mobile apps, logs, tickets, and static builds.
0Bit integrations use different credential classes for server calls, hosted/browser surfaces, and webhook verification. Only publishable keys and documented session-scoped browser values belong in client code.
Secret keys are backend-only
Never send secret keys, webhook secrets, partner secrets, or internal service credentials to a browser, mobile app, public repository, analytics event, support ticket, or customer-visible error.
Credential boundary
Credential classes
| Value | Where it belongs | What it does |
|---|---|---|
| Secret API key | Server runtime or secret manager. | Authenticates server-side 0Bit product API calls. |
| Webhook secret | Server runtime or secret manager. | Verifies signed webhook events. |
| Publishable key | Browser or mobile client. | Identifies the partner for browser-safe embed bootstrap. |
| Client secret | Browser or mobile client for one session. | Opens one hosted session, not a general API credential. |
Server pattern
function getObitServerConfig() {
const apiKey = process.env.OBIT_SECRET_KEY;
const webhookSecret = process.env.OBIT_WEBHOOK_SECRET;
if (!apiKey || !webhookSecret) {
throw new Error('missing_obit_server_config');
}
return { apiKey, webhookSecret };
}
async function createBrowserSession(input: CheckoutInput) {
const { apiKey } = getObitServerConfig();
const session = await hostedSessions.create({ apiKey, input });
return {
publishableKey: process.env.NEXT_PUBLIC_OBIT_PUBLISHABLE_KEY,
clientSecret: session.clientSecret,
};
}Rotation checklist
- Add the new key or secret to your secret manager.
- Deploy code that can accept both old and new webhook signatures if overlap is supported by your operating model.
- Move traffic to the new credential.
- Revoke the old credential after verification.
- Confirm no logs, build artifacts, or support tickets contain the old value.
Anti-patterns
| Anti-pattern | Risk |
|---|---|
Putting secret keys in NEXT_PUBLIC_*, VITE_*, or mobile build config. | Anyone can extract and use them. |
Logging Authorization headers. | Logs become credentials. |
| Pasting webhook secrets into tickets. | Support tools become secret stores. |
| Reusing one secret across sandbox and live. | Environment mistakes become harder to detect. |