This document outlines the secure process for exchanging API credentials. To ensure the confidentiality of your credentials, we will use a public-key encryption method. This process involves you, the client, generating a key pair and sharing the public key with us. We will then use this public key to encrypt your credentials before sending them to you.Please follow the steps below carefully.Step 1: Client-Side Key Generation#
First, you will need to generate a private and a public key pair on your system. The private key must be kept secret and secure, as it will be used to decrypt your credentials. The public key is what you will send to us.You can generate the key pair using the following openssl commands in your terminal:1. Generate a 2048-bit RSA private key:This command creates a file named private.pem containing your private key.
2. Extract the public key from the private key:This command creates a file named public.pem from your private key file.
After executing these commands, you will have two files: private.pem (your secret private key) and public.pem (your shareable public key).Action Required: Please send the public.pem file to us.
Do NOT send the private.pem file to us.
Step 2: Provider-Side Credential Encryption#
Once we receive your public.pem file, we will use it to encrypt your unique API credentials. This ensures that only you, the holder of the corresponding private key, can view them.We will then send the encrypted file, api-credentials.txt.enc to you.
Step 3: Client-Side Credential Decryption#
Upon receiving the api-credentials.txt.enc file from us, you will use your private key (private.pem) to decrypt it and reveal your API credentials.1. Decrypt the credentials using your private key:2. View your credentials:
The output of this command will display your decrypted API key and secret, which will look something like this:Api key: 01K0T1ZF9DK1C7PEBXMQBH52Q7
Api secret: yfV715HYxt6IZw1fRfK1rdOEG/+EibKJ38q7lvof/6I=
Org Id: 0198341f-dcaa-7d67-ba8f-61d917156bf9
Account Id: 0198341f-f1a3-78e0-9f80-7011662a4c2e
Important: Once you have decrypted your credentials, you must store them in a secure location within your system or application. Treat your api-key and api-secret as you would any password. Also, ensure that your private.pem file is stored securely and is not publicly accessible, as anyone with access to it can decrypt your credentials.
