NUWAY API
Security
Your API key gives full access to your company's conversations, leads and training data. Treat it like a password.
Keep the key on your server
Anyone who has it can read your conversations and leads and change your training data. Never put it in browser JavaScript, mobile apps or public repositories. If a key leaks, regenerate it.
Security checklist
- Keep the API key on your server; never ship it to browsers or apps.
- Store it in environment variables or a secrets manager, not in source code.
- Regenerate it when someone who knew it leaves, or if it may have leaked.
- Revoke it when you stop using the API.
- Check Last used on the API Key page; activity you don't recognise means the key should be regenerated.
Browser and mobile apps
Your frontend should talk to your own server, and only your server calls NUWAY with the key. See the server-side chat relay for a complete example.
WordPress and other CMSs
Don't paste the API key into theme files, page builders, custom HTML blocks or any code that runs in the browser. The NUWAY WordPress plugin doesn't need the API key: it uses your Company ID.
n8n
In n8n, store the key in a NUWAY API credential, not in node parameters or expressions. See n8n.
Rotating the key
Regenerating issues a new key and the old one stops working immediately. Update every integration that uses it right away. See Managing your key.