Protect the secret
Copy a newly generated API secret into the application’s secure secret manager. Do not put it in source control, screenshots, tickets, chat messages, or browser-side code.
Rotate a credential
- Open the application in API access settings and choose Rotate key.
- Store the replacement secret securely.
- Update the application and confirm successful requests.
- Remove the retired secret from every system that stored it.
Disable access
Disable the application immediately when it is compromised, no longer trusted, or no longer needed. Confirm that subsequent requests fail and review recent application activity.
Respond to suspected exposure
- Disable or rotate the affected credential before investigating through the compromised system.
- Record the application name, affected companies and scopes, and the suspected exposure period.
- Review available audit evidence for unexpected operations.
- Correct affected business data through its supported workflow and contact Eqdeal when unauthorized activity is possible.
Rotation does not reduce permissions
A replacement secret normally retains the application’s configured companies and scopes. Review and narrow those grants separately when the application needs less access.