---
title: "Security"
description: "Keep your API keys and account safe when integrating the API."
---

> Documentation Index
> Fetch the complete documentation index at: https://dev.messageport.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

You are responsible for every message sent through your account, so treat API access with care.

## Call the API from your server

Never call the API directly from a browser (JavaScript) or a mobile app. Anything shipped to a client exposes your API key to everyone who uses it.

Instead, add an endpoint on your own backend that your website or app calls, and have that endpoint call the API.

## Protect public forms

If a public form triggers SMS (sign-up codes, contact forms, call-me-back requests), add spam protection such as a CAPTCHA and per-user or per-IP limits on your side. Otherwise anyone can use your form to send messages at your expense.

For phone verification, also limit how many codes a user can request and how many guesses they can make. See [Verify](/guides/verify/#protect-the-flow).

## Manage keys

- Create a separate API key for each integration, so you can disable one without affecting the others.
- Store keys in environment variables or a secrets manager, never in source control.
- If a key leaks, disable it on the **API Keys** page in [MessagePort](https://app.messageport.com.au) and create a new one.

## Verify webhooks

Webhooks are signed with your account's webhook secret. Check the signature before trusting a payload. See [Signature verification](/guides/webhooks/#signature-verification).

Inbound MMS media URLs need no authentication to download, so treat them as secrets. See [Inbound MMS media](/guides/webhooks/#inbound-mms-media).

Source: https://dev.messageport.com.au/concepts/security/index.mdx