An API key that can spend money is as sensitive as a bank password. These practices apply to any API, including the SyllHost Reseller API.
- Never put keys in client-side code. No JavaScript, mobile apps or browser extensions.
- Use environment variables or a secrets manager. Not hard-coded strings.
- Keep keys out of Git. Add .env files to .gitignore and scan repositories for leaked secrets.
- Restrict by IP. Our keys can be limited to your server addresses. Calls from anywhere else get 403.
- Use one key per system. Separate keys for your website, your billing app and a developer's test script make revocation easy.
- Rotate regularly. Create a new key, switch your system, then revoke the old one.
- Revoke when staff leave. Anyone who knew a key should trigger rotation.
- Keep a low balance. Since orders are paid from a prepaid balance, a leaked key can only spend what is there. Top up only what you need.
- Never log keys. Mask them in application logs and error reports.
- Use HTTPS only.
- Monitor requests. Review recent API requests in your client area. Unknown IPs or unusual volume are red flags.
- Limit who can access servers that hold keys.
If a key leaks
- Revoke it immediately in your client area. It stops working at once.
- Create a new key and update your systems.
- Review recent orders, services and invoices for anything unexpected.
- Contact us through a ticket if you see unauthorised activity.
What the platform does for you
- Keys are stored as hashes, never in readable form.
- Repeated invalid keys from one IP are blocked for a time.
- Every request is logged (method, path, status, IP, time) without bodies or keys.
- Orders require sufficient balance and an Idempotency-Key.
Related: API authentication explained and website security tips.
A short example of a safe setup
A web agency runs a small server that creates hosting for new clients. The key lives in an environment variable on that server only. The key is restricted to the server's IP address. The agency keeps a small balance, topped up when it falls below a threshold. A separate key is used by the developer's laptop for testing, restricted to the developer's office IP. When the developer leaves, that key is revoked and the production key is rotated.
Detecting problems early
- Review the recent request log in your client area weekly.
- Alert when available_to_spend drops unexpectedly.
- Check that every order in your provider account matches an order in your own system.
Developer hygiene
Use pre-commit hooks that block secrets from being committed, and review any code you paste into public forums or AI tools for keys. Keys that appear in screenshots, support tickets or chat history should be treated as exposed and rotated.
FAQ
How often should I rotate keys?
At least yearly, and immediately after any suspected exposure or staff change.
Can I recover a lost key?
No, keys are shown once. Create a new key and revoke the old one.
Build with our API: read the Reseller API reference and the step-by-step guide. API access is enabled per account, so contact us to request it.