Skip to main content

Secrets and rotation

The credentials that connect Apple, RevenueCat, the SpendDaddy API, and AI agents give access to sensitive business data. Handle them like production secrets.

What should never be exposed​

  • Private keys
  • API tokens
  • Webhook URLs that include secrets
  • SpendDaddy API keys
  • Agent API secret keys
  • Event webhook signing secrets

Never embed the SpendDaddy API key or an agent key in a mobile app. Send events from your backend or another trusted server.

Rotate a credential​

RevenueCat webhook​

  1. Open Settings → Connections for the app.
  2. On the RevenueCat card, select Rotate webhook.
  3. Copy the new URL into RevenueCat right away. The previous URL stops working.

RevenueCat OAuth​

SpendDaddy encrypts RevenueCat OAuth access and refresh tokens and never displays them. To replace or expand project access, select Reconnect RevenueCat in the Add app flow. To disconnect, revoke SpendDaddy under RevenueCat Account → Security → Active OAuth tokens.

SpendDaddy API key​

  1. Open Settings → API & webhooks.
  2. Under First-party attribution API, select Rotate API key.
  3. Update the server-side secret used by your event sender. The previous key stops working immediately.

Agent API secret keys​

Organization owners manage agent keys in Settings → Agents. Select Rotate next to a key to replace it. The previous secret stops working immediately and the new one is shown once.

Event webhook signing secrets​

Owners manage event webhooks in Settings → API & webhooks. Select Rotate secret next to a webhook to replace its signing secret. SpendDaddy shows a signing secret once, when you create the webhook or rotate the secret. The previous secret stops signing new deliveries immediately, so update your receiver at the same time.

Apple credentials​

For Apple credentials, create the replacement with the same permissions, update it in SpendDaddy, and verify the connection before you revoke the old one.

Operational rules​

  • Keep credentials out of source control.
  • Use separate credentials for local, staging, and production.
  • Never paste secret values into shared logs or tickets.