Keep all management API keys server-side. The public VAST tag is not an API key.
Create keys carefully
- Prefer read-only keys for reporting dashboards.
- Use read/write keys only for trusted automation that needs to edit accounts or ads.
- Label keys per integration and revoke unused or exposed keys.
- Never put bearer tokens in URL query parameters or client-side scripts.
- Don't log full keys, personal advertising IDs, or other secrets.
Account isolation
API operations are scoped to the authenticated customer. Never use someone else’s numeric IDs in integration code. Treat resource IDs as account-local application data, not authorization tokens.
Browser calls
Don't assume the management API has browser CORS enabled or is suitable for frontend direct access. A server-side proxy you control is safer and prevents keys leaking to viewers.
Rate limiting
The current version limits requests per key; treat HTTP 429 and Retry-After as signals to back off. Build retries with exponential delays for transient failures.
Webhooks and SDKs
Current production webhook delivery and an official installable SDK are not implemented. Use documented JSON API routes and polling when necessary, within rate limits.