API Keys vs Wallet Private Keys
Explain the different authority of data-access credentials and wallet signing keys, so read-only integrations never request spending secrets unnecessarily.
Read the guideIndexbase journal / ideas for builders
Integration & review
Build clearer comparison workflows and deliberate access boundaries.
Follow the article feed34 articles / page 3 of 3
Explore integration & review
Wallet Signature Prompts in Data Applications
Make wallet authentication prompts understandable, bind signatures to a clear purpose and avoid disguising spending permissions as a harmless login.
Read the guideTracking Token Approval Revocations
Verify allowance state after a revocation attempt, preserve failed execution and distinguish a submitted revoke transaction from an effective permission change.
Read the guide
SSRF Protection for NFT Metadata Fetching
Fetch untrusted NFT metadata with scheme, destination and redirect controls, so a public token URI cannot become access to internal services.
Read the guideWhy API Keys Should Not Travel in URLs
Keep API credentials out of query strings, browser history and routine logs, using the service’s supported authorisation mechanism and safe redaction.
Read the guideSecurity Boundaries for Read-Only Wallet Integrations
Define what read-only means across credentials, API methods and product workflows, without confusing public-data access with permission to move funds.
Read the guidePrivacy of Wallet Labels and Customer Context
Protect off-chain wallet labels and ownership links even when transaction data is public, and apply access and retention rules to enriched reports.
Read the guideIP Allowlists for Backend API Credentials
Use IP restrictions as one access-control layer, account for proxies and outbound networks, and avoid treating a source IP as complete service identity.
Read the guideTesting Secret Redaction in API Logs and Errors
Verify that secrets stay out of logs, error responses and support artifacts, including nested payloads and failed configuration validation.
Read the guideAccess Controls for Wallet Data Exports
Secure report downloads with resource ownership checks, bounded access lifetimes and safe file handling, rather than relying on an obscure export URL.
Read the guideThe editorial approach
Useful questions.
Traceable explanations.
Each guide starts with a concrete developer question and separates technical observations from the interpretation an application adds. Worked examples use illustrative values; references point to standards and technical documentation.
Published by Indexbase. Explore related guides as your requirements develop, from a first data question to a more deliberate integration workflow.