Keep keys and secrets safe

Know which credentials can ship in an app and which must stay on a server.

Anything bundled into an iPhone or Mac app can eventually be inspected. A truly private credential must never live in client code, source control, screenshots, or prompts.

Public configuration vs. private secrets

Some providers issue client identifiers or publishable keys designed to be included in an app. Administrative tokens, service-role keys, signing secrets, and unrestricted API keys belong in a protected backend.

Protect production credentials

• Store secrets in Superapp’s secure environment settings or your backend.
• Use separate credentials for development and production.
• Restrict keys by service, app identifier, environment, and quota when supported.
• Rotate a credential immediately if it appears in code, chat, or a public log.