Protecting Passwords, Verification Codes, and API Keys

Different credentials protect different boundaries, but each can grant sensitive access. Treat passwords, one-time codes, recovery material, API credentials, and signing secrets according to their purpose and never combine them in an unsafe record.

Passwords prove account knowledge

Use a unique password that is not reused on another site. Store it in a trusted password manager and change it when compromise is suspected.

For Protecting Passwords, Verification Codes, and API Keys, treat “Passwords prove account knowledge” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

SMS codes authorize a moment

Enter an SMS code only in the official application session that requested it. Anyone asking you to forward the full code may be trying to take over the account.

For Protecting Passwords, Verification Codes, and API Keys, treat “SMS codes authorize a moment” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Authenticator codes are also secret

A six-digit authenticator code is temporary but still authorizes a sensitive action. Do not send it to support or save it in screenshots.

For Protecting Passwords, Verification Codes, and API Keys, treat “Authenticator codes are also secret” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Recovery codes need offline care

Recovery codes can bypass a missing second factor. Store them separately from the password and remove old copies after regeneration.

For Protecting Passwords, Verification Codes, and API Keys, treat “Recovery codes need offline care” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

API keys identify software access

An API key can perform machine actions for its owner. Restrict its IP whitelist, show it only to the intended system, and never place it in public code.

For Protecting Passwords, Verification Codes, and API Keys, treat “API keys identify software access” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Webhook secrets verify messages

Use the current signing secret to verify notifications before processing them. Rotate it through the supported control when exposure is suspected.

For Protecting Passwords, Verification Codes, and API Keys, treat “Webhook secrets verify messages” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Logs and screenshots can leak secrets

Do not print raw keys, tokens, complete codes, or authorization headers. Mask evidence before attaching it to a support request.

For Protecting Passwords, Verification Codes, and API Keys, treat “Logs and screenshots can leak secrets” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Respond to suspected exposure

Revoke or rotate the affected credential, end suspicious sessions where supported, review recent orders and transactions, and contact official support.

For Protecting Passwords, Verification Codes, and API Keys, treat “Respond to suspected exposure” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Practical checklist

1. Verify passwords prove account knowledge, record the result, and continue only when the next action is clear.
2. Verify sms codes authorize a moment, record the result, and continue only when the next action is clear.
3. Verify authenticator codes are also secret, record the result, and continue only when the next action is clear.
4. Verify recovery codes need offline care, record the result, and continue only when the next action is clear.
5. Verify api keys identify software access, record the result, and continue only when the next action is clear.
6. Verify webhook secrets verify messages, record the result, and continue only when the next action is clear.
7. Verify logs and screenshots can leak secrets, record the result, and continue only when the next action is clear.
8. Verify respond to suspected exposure, record the result, and continue only when the next action is clear.

Use the final platform status and account history as the source of truth. Do not share passwords, full verification codes, authentication secrets, access tokens, or API keys in screenshots or support messages. More guidance is available in the MangoOTP Help Center.