How we protect you
Keys are never stored in plaintext. We keep only a SHA-256 hash of every API key and root key. A copy of our database doesn’t yield working keys, and we can’t show you a key again after you create it. If you need to read a key back later, you opt in per keyspace. See Key storage. Access is scoped. A root key only works in the workspace that issued it, and every endpoint needs a specific permission. Dashboard users are either an admin or a developer. A developer who tries an admin-only action getsThis action requires admin privileges. See Team.
Changes are audited. Changes made in the dashboard appear in the audit log with who made them, the event, and a description. For example, renaming a workspace logs workspace.update. How long entries are kept depends on your plan. See Limits.
Security features you can use
Key storage
Hashing, verification, and the opt-in encrypted storage for recoverable keys.
GitHub secret scanning
What happens when a key is pushed to a public repository.
Delete protection
A flag that blocks deleting a keyspace, project, or app until you turn it off.
Two-factor authentication
Enroll a second factor on your own account.
Reporting a vulnerability
If you find a security issue, email security@unkey.com with steps to reproduce. Don’t open a public issue or pull request. Reports aboutapi.unkey.com and app.unkey.com are in scope. The docs site, the marketing site, and misconfigured self-hosted setups aren’t. The full policy is in SECURITY.md.