A Bartago API integration can manage contacts, campaigns, messages, or automations from another platform. That power creates a meaningful risk if a key leaks. An API key is a machine identity, not a static UI field. A sound baseline shows the raw key once, stores a hash or protected form, lists only a prefix or fingerprint, and records last-used metadata. Never place a long-lived workspace key in client JavaScript, a Flutter binary, Git, or a support screenshot.
Define scope and ownership
One key for one integration purpose
Create separate keys for production, staging, and each client or integration. Grant only required operations. Record the owner, created date, rotation target, and emergency contact.
Manage the secret lifecycle
Create, store, rotate, and revoke
Use a secret manager or protected server environment. During rotation, allow a short overlap, verify consumers on the new key, and revoke the old one. Mask keys in logs and error responses.
- Server-side only
- Least privilege
- Environment separation
- Rotation runbook
- Immediate revocation
Monitor for abuse signals
Unexpected volume and origin
Alert on unusual rates, endpoint mix, failure spikes, or source patterns. During an incident, revoke the key, pause affected campaigns, export the audit trail, and issue a replacement.
Practical checklist
- Named owner
- Scoped permissions
- Secret manager
- Masked logs
- Rotation tested
- Revocation tested
Key takeaway
API key security is not encryption alone; it is lifecycle management and blast-radius control.
Final thoughts
Inventory existing keys and replace any secret found in a browser, mobile bundle, or repository. Rotate and revoke a non-production key to test consumer behavior. If a secret is exposed, treat it as compromised and act immediately.
Verify consent, provider or carrier policy, and current applicable requirements before launching a campaign.
Start with 100 free automation credits →Common questions
Should an API key be stored in plaintext?
A verification-only key can be hashed. Recoverable provider credentials require authenticated encryption and strict access.
What should happen after a leak?
Revoke immediately, pause affected operations, audit logs, and issue a replacement.
Sources and editorial note
Last editorial review: August 1, 2026. Product behavior may change with releases; check current documentation.