API keys are credentials — anyone or anything that has one can act as your DoorSpot account within whatever it was granted. Follow these practices any time you create or manage a key, whether it's for a custom integration or an AI agent like Claude.
Steps to follow
Grant least privilege. Go to Settings > Developer and give each key only the Read/Write scopes it actually needs, and nothing more. Revisit this whenever an integration's purpose changes.
Use one key per integration. Never share a single key across multiple tools. If one integration is retired, breached, or misbehaving, a dedicated key lets you shut it off without touching anything else.
Store and share keys like passwords. Use a password manager or secrets vault. Never paste a key into email, chat, a spreadsheet, or a shared doc.
Be extra cautious with Write scopes. Think through the worst case: what could go wrong if this specific key were misused? Write access to financial resources — Invoices, Payments, Ledger Accounts, Ledger Entries — deserves the most scrutiny, since it can create or alter real financial records.
Rotate keys periodically, and immediately if exposed. There's no self-serve regenerate option in DoorSpot today — create a new key with the same scopes in Settings > Developer, update it everywhere the old value was used, and contact DoorSpot support to have the old key disabled. Do this on a schedule that matches your organization's security policy, and right away if you suspect a key has leaked — for example, it was accidentally committed to code, shared in a message, or a vendor had a breach.
Audit your connections regularly. Review the Settings > Developer list every few months. Use the "Last used" column to spot stale or abandoned keys, and contact DoorSpot support to have anything no longer needed disabled — especially after an employee who managed an integration leaves, or a vendor relationship ends. There's no self-serve revoke option in the app today.
Protect webhook secrets the same way. If you use webhooks, treat the signing secret exactly like an API key: store it securely, and rotate it via the API if it may have been exposed.
Use idempotency keys for retries. If a developer builds retry logic into an integration, using the
Idempotency-Keyheader prevents a network hiccup from accidentally duplicating a write action, like an invoice or a payment record.
Good to know
An AI-connected key (one created with Use with AI turned on) follows every practice above the same as any other key — the AI toggle adds data protection on top, it doesn't replace good key hygiene.
Renaming a key or editing its scopes takes effect immediately — but rotating or disabling a key entirely currently requires DoorSpot support, since there's no self-serve regenerate or revoke option.
Troubleshooting
I think a key may have been exposed: Create a replacement key with the same scopes right away, update it everywhere the old value was used, and contact DoorSpot support immediately to have the exposed key disabled.
An integration stopped working after you rotated a key: Confirm the new key's value was updated everywhere the old one was used, and that DoorSpot support has disabled the old key.