Protect Public API Key

The Public API Key is used for client SDK initialization and can appear in Web, iOS, or Android client code. It is not the only security measure; also configure access-side verification.

Web endpoints

• Add only the actual business domain name and page source in Allowed Origins and Allowed Referers.
• Configure test and production endpoints separately to avoid adding the test domain name to the production whitelist for a long time.
• The protocol, port, domain name and path rules are filled in according to the console format.

iOS and Android endpoints

• iOS configures the correct Bundle ID.
• Android is configured with the correct Package Name and App Signature.
• Check the values from the actual release package and signing configuration, do not directly use the configuration of other environments.

Control abnormal traffic

Set minute-level and hour-level rate limits on the endpoint, and reserve a margin based on normal peak values. Regularly check the organization usage and endpoint usage; if there is abnormal growth in a short period of time, please first check repeated initialization, abnormal retry and source configuration, or continue to check why the request is restricted.