Guides
The reasoning behind the tools: how to create, verify, store, rotate and revoke credentials, with working code and the mistakes that actually cause incidents.
- API Key vs JWT vs OAuth Token — Which Should You Use?API keys, JWTs and OAuth 2.0 tokens solve different problems and are often confused. A clear comparison of what each one is, how it is verified and revoked, and a decision guide for choosing between them.October 24, 2026 · 5 min read
- Fixing AWS SignatureDoesNotMatch — A SigV4 Debugging GuideHow AWS Signature Version 4 is built step by step, how to read the canonical request AWS sends back in the error, and the ten causes behind nearly every SignatureDoesNotMatch and "signature expired" error.October 24, 2026 · 5 min read
- How to Generate Secure API Keys for Your APIA complete walkthrough for issuing API keys from your own service — how much entropy you need, working code for Node.js, Python, Go and OpenSSL, prefix and checksum design, and how to store keys so a database leak is not a breach.October 24, 2026 · 7 min read
- Is It Safe to Paste API Keys and JWTs Into Online Tools?When an online decoder, generator or hash tool is safe to use with real credentials, how to check in thirty seconds whether a tool sends your input to a server, and what to do if it already has.October 24, 2026 · 4 min read
- Leaked an API Key? What to Do in the First HourA step-by-step incident checklist for an API key or secret committed to GitHub, pasted in a chat or exposed in a frontend bundle — revoke, audit, clean up history and prevent the next one, in that order.October 24, 2026 · 5 min read
- How to Verify Webhook Signatures (Stripe, GitHub, Shopify, Slack)Exactly which bytes Stripe, GitHub, Shopify, Slack and Standard Webhooks sign, with working Node.js and Python verification code, and the raw-body, timing and replay mistakes that make verification silently fail.October 24, 2026 · 6 min read
- Where to Store API Keys Securely — Frontend, .env and Secrets ManagersWhy API keys can never be hidden in frontend code, how to use .env files without leaking them, and when to move to a secrets manager — with concrete patterns for React, Next.js, Vite, Docker, Kubernetes and CI.October 24, 2026 · 5 min read