search
Netmera Docs

API Key Security & Netmera Safeguards

Most issues come from REST API keys being exposed or panel accounts being accessed by the wrong person. The impact is highest when a key can trigger messaging actions. This page explains how Netmera keys work and how to lock them down.

hashtag
API Key Architecture (SDK vs. REST)

Netmera uses a split model. SDK keys and REST API keys have different scopes and use cases.

hashtag
SDK key (client-side)

  • Used by the Netmera SDK in your apps.

  • Expected to be present in the application bundle.

  • Do not rely on it for privileged operations.

hashtag
REST API key (server-side)

  • Used for server-to-server integrations.

  • Not required for any in-app use case.

  • Don’t embed it in a mobile app or web frontend.

circle-exclamation

If a REST API key is shipped in a client app, it can be extracted. Reduce the blast radius with REST API IP whitelisting.

hashtag
Key Generation & Storage Model

  • Keys are generated when a specific panel user requests them for a specific app.

  • Keys are not stored in plaintext. Access is controlled by panel authorization.

  • Different users of the same app may see different keys. This does not change permissions. It helps you trace an exposed key back to a panel account.

hashtag
REST API IP Restriction (Whitelist)

Restrict REST API usage with an IP whitelist. This blocks requests from unknown networks, even if a valid key leaks.

circle-info

Use a small set of stable outbound IPs. Example: your API gateway, VPN egress, or a dedicated NAT.

hashtag
Panel Access & Security Options

API keys are accessible only through the Netmera panel. Lock panel access down first.

  1. Email/SMS OTP: Users must enter a one-time password to access the panel/app. (For more details on authentication, see Control Panel )

  2. IP-Restricted User Login: Allows access only from approved IP ranges (e.g., a company VPN/network).

  3. Domain-Restricted User Login: Limits panel user creation and access to specific email domains, ensuring only users from approved domains can access the app.

hashtag
Additional Panel Authorization Controls:

  • Role-Based Access Control: API key visibility can be restricted by panel roles.

  • Approval Mechanism (Approver): Message sending can be configured to require approval. Messages are not sent unless an authorized approver confirms the action.

For roles and approval flows, see Roles and Permissions.

circle-check

hashtag
Recommended Setup

1

Keep REST API keys server-side only

Do not ship REST keys in mobile apps. Do not use them in browser JavaScript.

2

Enable REST API IP whitelisting

Allow only your backend outbound IPs.

3

Enforce stronger panel authentication

Enable Email/SMS OTP in General Settings.

4

Reduce who can view keys

Use roles to limit API key visibility. Keep “admin” access rare.

5

Require approvals for message sending (optional)

Turn on Approver if you have multiple operators.

PreviousCoupon Code Lists

Last updated

Was this helpful?