Auth separation
JWT Bearer for dashboard and key management; X-API-Key only on data endpoints.
Axix OWL
Keep data keys out of human sessions
Axix OWL separates JWT account management from X-API-Key data calls, with create / list / revoke controls and usage history for forensics.
A shared enrichment password is not an access model
When one password powers every Bulk Search job, revoke becomes a company-wide outage. API keys let you kill a single client without resetting humans.
Security pillars
Key lifecycle
Create, list, and revoke keys without changing plan tier.
Tenant isolation
Credits, keys, and usage history stay inside the account boundary.
Observable spend
Usage history attributes credits to calls and keys after incidents.
Hardening checklist
- Store API keys in a secrets manager
- Separate staging and production keys
- Revoke on employee or vendor offboarding
- Alert on unexpected usage spikes
- Treat 401/403 as credential incidents
- Never embed keys in public client bundles
Incidents
Revoke first, investigate with usage history
When a key may be exposed, revoke it from the dashboard, issue a replacement, then use usage history to see what was called and how many credits moved.
- Immediate revoke stops data calls
- Replacement key restores jobs deliberately
- History shows endpoint-level spend
- 402/429 patterns can reveal misuse vs capacity
Recommended key posture
Least privilege keys
One key per system or environment.
Named ownership
Every key has a human owner in the dashboard.
Rotation cadence
Rotate on a schedule — not only after incidents.
Enterprise admins
Use admin controls on large multi-tenant accounts.
Controls that matter day one
2
Auth modes to keep separate
3
Key verbs: create, list, revoke
5
Error classes clients must handle
1
Usage trail per credit spend
Enterprise governance
Enterprise plans pair Unlimited rate limits and 1,000,000 credits with the same key and usage controls — capacity without abandoning revoke discipline.
Axix OWL
See Security beside a live credit balance
Open Security next to remaining credits so every returned lead, email, or successful company lookup is visible before it lands in CRM or outreach.
