API keys and webhook signing secrets are shown once at creation.
Store them in a password manager or server environment variables
Never commit them to Git, paste them into screenshots, or put them in frontend code
Use read keys for dashboards and polling; use write only on trusted servers
Verify webhook signatures and reject old timestamps (see Outbound webhooks)
If a key or secret might be exposed: delete it in Integrations, create a new one, and update every system that used the old value. Treat it like a password rotation.