---
title: "Keep keys and secrets safe"
description: "Know which credentials can ship in an app and which must stay on a server."
---
Anything bundled into an iPhone or Mac app can eventually be inspected. A truly private credential must never live in client code, source control, screenshots, or prompts.

## Public configuration vs. private secrets

Some providers issue client identifiers or publishable keys designed to be included in an app. Administrative tokens, service-role keys, signing secrets, and unrestricted API keys belong in a protected backend.

## Protect production credentials

-   Store secrets in Superapp’s secure environment settings or your backend.
-   Use separate credentials for development and production.
-   Restrict keys by service, app identifier, environment, and quota when supported.
-   Rotate a credential immediately if it appears in code, chat, or a public log.