Developer reference
Protect integration secrets
Client bundles and repositories are not secret stores.
1 min read · 128 words
Client bundles and repositories are not secret stores. The developer console supports app records, scoped API keys, and webhook registration. Registration does not mean webhook delivery is enabled. No isolated sandbox, published quota system, or generic /api/v1 API is documented here. Keep secret credentials on trusted servers.
What to expect
The developer console supports app records, scoped API keys, and webhook registration. Registration does not mean webhook delivery is enabled. No isolated sandbox, published quota system, or generic /api/v1 API is documented here. Keep secret credentials on trusted servers.
Client bundles and repositories are not secret stores. This guide covers 3 practical actions, in the order they usually happen.
Do this first
Keep API keys in a server-side secret manager..
Exclude local environment files from version control..
Then finish with
Rotate any key that was exposed..
Good to know
Everything here reflects the current Merchant Bridge interface. Labels and buttons may move as the product evolves, but the flow stays the same: prepare, act on the page this guide references, and confirm the result before moving on.
When something does not match what you see, the destination page for this guide is the source of truth.
Need help with a specific error? Contact Merchant Bridge with the page and visible error, without passwords or secret keys.