Account and API Security

July 16, 2026 ยท View on GitHub

Control of the registration account can redirect every service under the domain. Protect it as production infrastructure.

Account Controls

  • Use a unique password generated and stored by a password manager.
  • Enable the strongest multi-factor authentication available in the current Dashboard.
  • Protect the email account used for recovery with separate multi-factor authentication.
  • Review active sessions and connected accounts when those controls are available.
  • Sign in only through the official Dashboard address.
  • Treat urgent domain-expiration or suspension messages as untrusted until verified in the Dashboard.

Recovery Plan

Document:

  • Account owner
  • Recovery email owner
  • Approved administrators
  • Where recovery codes are stored
  • Renewal responsibility
  • Incident contact

Do not store recovery codes in the same unencrypted file as the password.

API Keys

Create an API key only for a defined automation task.

  • Prefer the smallest available scope.
  • Use a separate key for each application or environment.
  • Store keys in a secret manager or protected environment variable.
  • Never put keys in URLs, screenshots, issue reports, frontend JavaScript, or Git commits.
  • Rotate a key after staff changes, suspected exposure, or unexplained activity.
  • Delete unused keys.

Example shell pattern:

export REGISTRATION_API_TOKEN='load-this-from-a-secret-store'

Do not place the real value directly in shell history or a committed script.

Check a Repository for Accidental Secrets

Before publishing code:

git status --short
git diff --cached
git grep -n -i 'api[_-]*key\|token\|secret\|password'

These checks can miss encoded or unusual secrets. Use a dedicated secret scanner in the development workflow and review its findings.

If a secret is committed, removing the visible line is not enough. Revoke or rotate the credential immediately, then handle repository history according to the project's incident procedure.

Nameserver Change Alerts

Where monitoring is available, alert on:

  • Nameserver changes
  • Unexpected address changes
  • Certificate issuance
  • Domain expiration approaching
  • New API keys or login events
  • Website content or TLS failures

Continue to Acceptable Use and Abuse Response.