API Key Security, Permissions & Best Practices

Security Guidelines for Nimbica API Keys

Your API key grants permission to trigger AI builds, optimize assets, and update edge content. Follow these best practices to keep your account secure:

Best Practices Checklist

• Never Commit Keys to Public Repositories: Do not hardcode API keys into public theme files or GitHub repositories.
• Use Separate Keys Per Client Site: For agencies and multi-site owners, always generate individual site-specific keys rather than sharing master credentials.
• Immediate Key Rotation: If a team member leaves or an environment is decommissioned, regenerate your site key with 1 click from the Nimbica Dashboard.
• Use Email Login for Solo Sites: If you manage your own single site, using email/password login in the plugin is simpler and equally secure — no key management needed.