Skip to main content

Secrets and rotation

The credentials used to connect Apple, RevenueCat, and the SpendDaddy API can grant access to sensitive business data. Handle them like production secrets.

What should never be exposed​

  • Private keys
  • API tokens
  • Webhook URLs that include secrets
  • SpendDaddy API keys

Never embed the SpendDaddy API key in a mobile app. Send events from your backend or another trusted server-side gateway.

Rotate a credential​

RevenueCat webhook​

  1. Open the app's Settings page in SpendDaddy.
  2. Rotate the RevenueCat webhook.
  3. Copy the new URL into RevenueCat immediately. The previous URL stops working.

SpendDaddy API key​

  1. Open Settings > First-party attribution API.
  2. Rotate the API key.
  3. Update the server-side secret used by your event sender. The previous key stops working immediately.

For Apple or RevenueCat API credentials, create the replacement with the same required permissions, update it in SpendDaddy, and verify the connection before revoking the old credential.

Operational rules​

  • Keep credentials out of source control.
  • Use unique, environment-specific credentials for local, staging, and production.
  • Never paste secret values in shared logs or tickets.