Use of API Tokens in Client Applications

API tokens serve as credentials for authenticating and authorizing API requests. When using API tokens, follow these practices:

• Keep Tokens Secret: API tokens are like passwords; they grant access to resources. Keep them secret and avoid hardcoding them in your application’s client-side code or publicly accessible repositories.
• Secure Storage: Store tokens securely on the client side. Avoid storing them in plain text or using insecure storage mechanisms like local storage or cookies. If deploying tokens in server-side applications, use environment variables or a secure secrets management system (preferred) to store and access them.
• Audit Logs: Keep audit logs of token usage to monitor for suspicious activity and unauthorized access attempts. Search LogicMonitor’s Audit Log for related events.
• Single Purpose: Generate unique tokens for each client or application. One token should only be used from one source location and for one purpose.
• Educate Users: Educate developers and users about the importance of API token security and best practices for handling them.