How to Secure Your API Account

To secure your API account, follow these steps:

• Use Strong, Unique Passwords
  Make sure your API password is strong and unique. Avoid using the same password for both your API and other accounts. A password strength indicator can help you create a robust password.

• API IP Address Lockdown / Whitelist (fixed-IP servers only)
  If your app always calls us from the same IP address, lock your API to it on the API Lock page. Requests from any other IP are then rejected, even with the correct password.
  Do not enable this if your IP changes. Cloud hosts like AWS, Azure, and Google Cloud often send requests from a different IP than the one you saw yesterday, and a shared or home connection can change IP at any time. If you lock your API to an IP that later changes, your own requests get blocked and your sending stops until you update the list.

• Change Passwords After Sharing
  If you ever share your API password with someone, ensure you change it afterward. Never trust anyone with your account password, as it could lead to unauthorized access.

• Regularly Review Access and Permissions
  Periodically review who has access to your API and what permissions they have. Remove any unnecessary access and regularly audit your API logs for any suspicious activity.

• Enable Two-Factor Authentication (2FA)
  If your API provider offers 2FA, enable it. Two-factor authentication adds an extra layer of security by requiring an additional verification step, usually via SMS or an authenticator app.

• Keep API Keys Secure
  Treat your API keys as sensitive information. Avoid hardcoding them into your code or sharing them publicly. Store them securely and consider rotating them periodically.

• Stay Informed About Security Best Practices
  Stay updated on the latest security best practices for API usage. Follow security blogs, attend webinars, and participate in relevant forums to stay informed about potential threats and mitigation strategies.

By following these steps, you can significantly enhance the security of your API account and minimize the risk of unauthorized access or data breaches.

Please read our SMS API implementation best practices guide.

* If you are an App owner you can use our SMS API Testing Checklist, to find problems in the API implementation and fix them, which will save you time and money.