Security is foundational to Unkey. We handle API keys for your production systems, so we take this responsibility seriously.
Key security principles#
We hash your API keys before storage. Even if our database were compromised, attackers couldn't recover the original keys.
Create, rotate, and revoke keys instantly. Changes propagate globally within seconds.
Root keys use explicit permissions. Grant only what's needed for each use case.
Every key operation is logged. Know who did what, when, from where.
How API key storage works#
When you create an API key through Unkey:
Key generation
We generate a cryptographically random key (e.g., sk_live_abc123xyz...)
Key returned to you (once)
The plaintext key is returned in the API response. This is the only time you'll see it.
Hash stored
We compute a SHA-256 hash of the key and store only the hash in our database.
Verification
When a key is verified, we hash the provided key and compare it to the stored hash. Match = valid.
This is the same approach used by GitHub, Stripe, and other security-conscious platforms. Even with full database access, an attacker cannot recover your original keys.
Root keys#
Root keys authenticate your requests to the Unkey API itself. They're how you create, manage, and verify API keys programmatically.
Best practices:
- Use separate root keys for different environments (dev, staging, production)
- Grant minimal permissions, only what each service needs
- Rotate root keys periodically
- Never commit root keys to version control
Infrastructure security#
| Layer | Protection |
|---|---|
| Transport | All API traffic uses TLS 1.3. No plaintext connections accepted. |
| Infrastructure | Requests are processed across our globally distributed infrastructure, with DDoS protection. |
| Database | Encrypted at rest and in transit. Regular backups with point-in-time recovery. |
| Access | Internal access requires multi-factor authentication and is logged. |
Compliance & certifications#
We have SOC 2 Type II certification which you can find in our trust center . If you have specific compliance requirements, contact us to discuss.
Responsible disclosure#
Found a security issue? We appreciate responsible disclosure.
- Email: security@unkey.com
- Please include steps to reproduce
- We'll acknowledge within 48 hours
More security features#
Fine-grained access control for your root keys
Restrict key verification to specific IP ranges
What to do if a key is compromised
Automatic detection of leaked keys in public repos
Prevent accidental deletion of critical keys