Skip to main content
Finkkle One is currently undergoing a major overhaul. Finkkle One services, including API access, are down or disabled until further notice. Finkkle Trends remains accessible. More details soon.
Keeping your Finkkle account, workspace, and integrations secure is a shared responsibility. Follow these practices to minimize risk across search, Spaces conversations, API integrations, and automation workflows.

​
API keys

Keep keys server-side

Never include API keys in client JavaScript, mobile app source code, or public repositories. Store them in environment variables on your backend.

Rotate on access changes

Revoke and regenerate any key when a team member leaves, a repo is exposed, or a deployment environment changes.

Use scoped keys

Create separate keys for each environment (development, staging, production) and each integration. A compromised dev key should not affect production.

Use short-lived sessions

In browser-based integrations, use short-lived session tokens rather than long-lived API keys. Refresh tokens on each session.

​
Managing keys in Finkkle One

  1. Go to one.finkkle.com and sign in
  2. Click Create API key — give it a descriptive, environment-specific name
  3. To revoke: open the key list, click the key, and select Revoke
  4. Revoking takes effect immediately — all requests using the revoked key will return ERR_AUTH_FAILED

​
Workspace access

  • Least privilege — give each collaborator, plugin, and automation the minimum access needed for the task
  • Review regularly — audit connected plugins, automation permissions, and workspace members on a regular cadence
  • Shared Spaces are team-visible — treat content in shared Spaces as visible to all workspace members unless your workspace policy explicitly restricts it
  • Automation permissions — before enabling a write or send automation, verify the permission scope and test it in observe-only or draft-only mode first

​
Data and privacy

  • Send only what’s needed — include only the data required for the task in API calls and Spaces prompts
  • Remove credentials from files — scrub API keys, passwords, and personal identifiers from documents before uploading them to Spaces
  • Verify before publishing — review AI-generated content before publishing it externally. Models can produce plausible-but-incorrect information.
  • Audit high-impact automations — for automations that interact with external services, keep a run history and review it periodically
Never include passwords, private keys, auth tokens, or sensitive personal data in Spaces prompts, conversation history, or API request bodies. This data may be logged for debugging and support purposes.

​
Incident response

If you suspect unauthorized access or a key has been compromised:
1

Stop the affected integration

Disable the integration or automation that may be affected. Revoke the API key immediately from the Finkkle One dashboard.
2

Gather evidence

Capture request IDs, timestamps, affected endpoints, and the smallest useful reproduction of the issue. Avoid logging full request bodies that may contain sensitive data.
3

Notify your workspace owner

If the incident affects a shared workspace, notify the workspace owner and any affected team members.
4

Contact support

Email [email protected] with your incident summary, affected key names (not the key values themselves), request IDs, and timestamps. The team will help investigate and confirm the scope.

​
Security boundary

Finkkle cannot infer access you have not explicitly granted. Permissions, external actions, and data access are always explicit — if you have not authorized it, Spaces and the API will not assume it.