> ## Documentation Index
> Fetch the complete documentation index at: https://docs.projectecho.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security basics for API keys, embed tokens, and webhooks

> Protect API keys, My app embed tokens, and webhook secrets in Project Echo.

Project Echo secrets unlock powerful automation. Treat API keys, embed tokens, and webhook secrets like passwords.

## API keys (`pe_api_…`)

* Created under **API & MCP** (Workspace nav).
* Require **both** `Authorization: Bearer …` and `X-PE-API-Key-Id`.
* Tokens are shown once — store them in a secret manager or server environment.
* Prefer least privilege and separate keys per environment or agent.
* **Revoke** immediately if a key may have leaked; create a replacement.

## My app / embed tokens

* Created under **Integrations → My app**.
* Restrict **allowed origins** to your real app hosts.
* Inject user fields from your **backend** into the embed snippet — do not let browsers invent trusted identity without your server.
* Rotate/revoke embed keys when rotating other production secrets.
* Keep portal `pe_token` links short-lived; do not log them in analytics if avoidable.

## Webhooks

**Outbound**

* Signing secrets look like `pe_whsec_…` and are shown once.
* Verify `X-PE-Signature` (HMAC-SHA256 of the **raw** body) before trusting a payload.
* Use HTTPS endpoints you control.

**Inbound**

* Receive URLs contain a secret token (`pe_in_…`). Treat the full URL as a secret.
* Disable or delete unused inbound endpoints.
* Map only the fields you need; validate email/title in your sending tool when possible.

## General practices

* Never commit secrets to git or paste them into public tickets.
* Limit who can open **API & MCP**, **Integrations**, and billing-sensitive Settings pages.
* After a teammate leaves, revoke keys they may have copied and review active webhooks.

If you suspect exposure, revoke the affected secret first, then email [support@projectecho.io](mailto:support@projectecho.io). Docs: [Help Center](https://docs.projectecho.io/).


## Related topics

- [Connect AI tools with MCP (Claude, Cursor, and others)](/api-mcp-and-embed/connect-mcp.md)
- [Create and manage API keys](/api-mcp-and-embed/create-manage-api-keys.md)
- [Integrations overview](/integrations/integrations-overview.md)
- [Embed Project Echo in your product (My app / identify users)](/api-mcp-and-embed/embed-my-app.md)
- [Where to get help (support and this knowledge base)](/billing-and-account/where-to-get-help.md)