Keeping your account secure

The realistic risk to a marketing account is not someone guessing your password. It is a credential you created, pasted somewhere, and forgot.

Audit your keys occasionally

Settings lists both API keys and Service Accounts, each showing Last used: and Last IP:.

Two questions, once a quarter:

• Is anything unused? Delete it. Every credential you remove is one fewer thing that can leak.
• Does any Last IP look unfamiliar? Worth understanding before assuming it is fine.

Scope narrowly

Both key types take Scopes. A read-only key that leaks is an information problem; a write key that leaks is a sending problem — and sending from your domain is the one that damages the asset you cannot quickly rebuild.

Rotate rather than swap

Keys have a Rotating out state for exactly this: create the new key, deploy it, watch Last used on the old one fall to nothing, then delete it. Deleting a live key first breaks whatever was using it, usually at the worst moment.

If something leaks

Delete it immediately and create a replacement. Do not wait to find out whether it was used — the delete is cheap and the investigation is not.

Connected accounts

Store connections are read-only and every connection can be disconnected at any time, so a connection is not a route into your store. See What access a connection asks for.

Who else can see this

Everything lives inside a workspace, and workspaces are separate from each other. If you are handing a client access to their own data, a separate workspace is the structure to use rather than sharing credentials. See Workspaces.

Next: open Settings and check Last used on every key and service account — delete anything you do not recognise.