Credential Hygiene

The developer portal treats secrets as server-side or environment-managed material.

Do

• Use OAuth sign-in where supported.
• Store static tokens in environment variables, keychains, or secret managers.
• Use HttpOnly secure cookies for portal sessions.
• Copy generated API tokens once and store them outside the browser.
• Redact tokens from logs, screenshots, terminal output, and issue reports.

Do Not

• Do not commit JWTs, cookies, client secrets, or generated local state.
• Do not put bearer tokens in browser localStorage.
• Do not paste production tokens into shared docs, tickets, or chat.
• Do not claim fine-grained token scopes unless the issuer actually supports them.

Token Scope

The analytics service issues opaque managed API keys from the authenticated OAuth owner's identity. Each public key maps to a separate encrypted internal ADM credential and can be reported on, rate limited, and revoked independently.

The public key is displayed once. The API Access page can later show only its non-secret prefix and lifecycle metadata; neither the public secret nor mapped internal token is recoverable through the portal.

Environment Variables

Copied API examples already contain the API hostname for the current portal environment. Only the bearer token needs to be supplied separately:

export AQL_BEARER_TOKEN="<token-from-api-access>"