> ## Documentation Index
> Fetch the complete documentation index at: https://docs.finkkle.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Finkkle Security Best Practices for Accounts and Integrations

> Security best practices for Finkkle — protecting your API keys, managing workspace access, handling data safely, and responding to security incidents.

<Warning>
  **Finkkle One is currently undergoing a major overhaul.** Finkkle One services, including API access, are down or disabled until further notice. Finkkle Trends remains accessible. More details soon.
</Warning>

Keeping your Finkkle account, workspace, and integrations secure is a shared responsibility. Follow these practices to minimize risk across search, Spaces conversations, API integrations, and automation workflows.

## API keys

<CardGroup cols={2}>
  <Card title="Keep keys server-side" icon="server">
    Never include API keys in client JavaScript, mobile app source code, or public repositories. Store them in environment variables on your backend.
  </Card>

  <Card title="Rotate on access changes" icon="arrows-rotate">
    Revoke and regenerate any key when a team member leaves, a repo is exposed, or a deployment environment changes.
  </Card>

  <Card title="Use scoped keys" icon="key">
    Create separate keys for each environment (development, staging, production) and each integration. A compromised dev key should not affect production.
  </Card>

  <Card title="Use short-lived sessions" icon="clock">
    In browser-based integrations, use short-lived session tokens rather than long-lived API keys. Refresh tokens on each session.
  </Card>
</CardGroup>

### Managing keys in Finkkle One

1. Go to [one.finkkle.com](https://one.finkkle.com) and sign in
2. Click **Create API key** — give it a descriptive, environment-specific name
3. To revoke: open the key list, click the key, and select **Revoke**
4. Revoking takes effect immediately — all requests using the revoked key will return `ERR_AUTH_FAILED`

## Workspace access

* **Least privilege** — give each collaborator, plugin, and automation the minimum access needed for the task
* **Review regularly** — audit connected plugins, automation permissions, and workspace members on a regular cadence
* **Shared Spaces are team-visible** — treat content in shared Spaces as visible to all workspace members unless your workspace policy explicitly restricts it
* **Automation permissions** — before enabling a write or send automation, verify the permission scope and test it in observe-only or draft-only mode first

## Data and privacy

* **Send only what's needed** — include only the data required for the task in API calls and Spaces prompts
* **Remove credentials from files** — scrub API keys, passwords, and personal identifiers from documents before uploading them to Spaces
* **Verify before publishing** — review AI-generated content before publishing it externally. Models can produce plausible-but-incorrect information.
* **Audit high-impact automations** — for automations that interact with external services, keep a run history and review it periodically

<Warning>
  Never include passwords, private keys, auth tokens, or sensitive personal data in Spaces prompts, conversation history, or API request bodies. This data may be logged for debugging and support purposes.
</Warning>

## Incident response

If you suspect unauthorized access or a key has been compromised:

<Steps>
  <Step title="Stop the affected integration">
    Disable the integration or automation that may be affected. Revoke the API key immediately from the Finkkle One dashboard.
  </Step>

  <Step title="Gather evidence">
    Capture request IDs, timestamps, affected endpoints, and the smallest useful reproduction of the issue. Avoid logging full request bodies that may contain sensitive data.
  </Step>

  <Step title="Notify your workspace owner">
    If the incident affects a shared workspace, notify the workspace owner and any affected team members.
  </Step>

  <Step title="Contact support">
    Email [support@finkkle.com](mailto:support@finkkle.com) with your incident summary, affected key names (not the key values themselves), request IDs, and timestamps. The team will help investigate and confirm the scope.
  </Step>
</Steps>

## Security boundary

<Note>
  Finkkle cannot infer access you have not explicitly granted. Permissions, external actions, and data access are always explicit — if you have not authorized it, Spaces and the API will not assume it.
</Note>