API Rate Limiting and Security

Overview

API security protects audit data from leaks, excessive requests, and misuse.

Production rules

• Use HTTPS only.
• Store API keys in server-side environment variables.
• Use one key per integration.
• Use minimum required scopes.
• Use date filters and pagination.
• Revoke unused or exposed keys.

Safe retry pattern

try request
if timeout or 429:
  wait using exponential backoff
  retry a limited number of times
if 401 or 403:
  stop and alert admin
if 500:
  log failure and check Plugin Health

Common mistakes

• Running heavy API jobs every few seconds.
• Embedding API keys in JavaScript.
• Using one shared key for vendors, dashboards, and scripts.