Security

Updated 2026-10-25

How APIs.Dev keeps your keys, your credentials, your Customers’ records and their payments safe.

Signing in

You sign in with GitHub, so APIs.Dev holds no password of yours. The CLI and the docs MCP sign in the same way.

Keys

Each Customer gets a Live key and its Test twin. A Test key never moves money. A call record keeps a digest of the key, never the key, and every reply carries an X-Request-Id you can look up.

Your Source credentials

A Source’s credential is a secret() you set with npx apis.dev secrets set. It never sits in your file, your repository or a reply.

Your Customers’ records

Each Customer’s records sit in that Customer’s own space. A Key reads and writes only its own Customer’s records, and only the Verbs its Role allows.

Webhooks

Every delivery is signed t=…,v1=HMAC("{t}.{body}") with your endpoint’s secret, and a receiver refuses a signature older than five minutes, so a captured delivery cannot be replayed.

Payments

Card details go to Stripe and never reach APIs.Dev. Your Customers pay into your own connected Stripe account.

Data processing

APIs.Dev processes your Customers’ data on your behalf, under a data processing agreement (DPA) you sign from your account. What APIs.Dev keeps about you is on the Privacy page.