8.6Keeping secrets safe: good practice

• Copy the value when it is shown and keep it in your own password manager. obsrvly shows it only once.
• Never type a password or token straight into a fill step, URL, header or body. Always use a secret.
• Use a dedicated test account for monitoring, not a real person's account. Give its tokens as little access as possible.
• Keep allowed sites narrow. Prefer exact names such as app.example.com to wildcards. Remember that *.example.com does not cover example.com.
• Use clear names for each environment, such as STAGING_API_TOKEN and PROD_API_TOKEN. Later, the name is all you can see.
• Protect your API keys (chapter 13). An API key can create, list and delete secrets.
• Does your team owner want to know who created, changed or deleted a secret? They can check billing → audit log (14.5). Values are never recorded there.

If a value is lost or may have leaked#

1. Change the password or token at its source, in the service it belongs to.
2. In obsrvly, delete the secret.
3. Create it again at once with the same name and the new value.