Security best practices

Production checklist

• Call Daily from trusted server-side workloads only.
• Store keys in a managed secret store or encrypted environment injection.
• Create a separate key for each integration and environment.
• Grant only the permissions the integration uses.
• Restrict stable workloads with IPv4, IPv6, or CIDR allowlists.
• Choose an expiration appropriate to your rotation process.
• Rotate before expiration and verify the replacement during the 24-hour grace window.
• Revoke keys immediately when no longer needed.
• Never put keys in URLs, frontend bundles, mobile apps, source control, build artifacts, tickets, or chat.
• Redact Authorization, API-key patterns, signed PDF URLs, and sensitive response fields from logs and error reporting.
• Store only required response data and apply your own access and retention controls.

Logging

Useful request telemetry includes HTTP method, normalized public route, status, duration, your internal trace ID, and Daily request_id. It must not include the raw query if search values are sensitive, the Authorization header, a complete resource response, or signed download URLs.

Daily accepts a safe X-Request-ID and returns it for correlation. Generate an opaque identifier; never reuse a customer email, business number, or API key as a request ID.

Exposure response

If a key may have leaked:

1. Revoke it immediately in Daily → API keys. Do not rotate and leave the exposed key valid during grace.
2. Create a replacement with minimum permissions and, where practical, an IP allowlist.
3. Update the secret store and redeploy affected workloads.
4. Search logs, repositories, CI output, support systems, and artifacts for the exposed value; remove it under your incident procedures.
5. Review key last-use information and integration logs for unexpected routes, times, or source networks.
6. Record relevant Daily request IDs and contact Daily support without sending a key.

Browser playground

The portal has no analytics or third-party scripts. Its playground keeps the key only in component state, uses direct CORS requests with credentials: omit, never constructs a URL containing the key, and clears state on refresh. This does not make browser-embedded keys safe for your own application.