UPCS API Security Checklist

Run through this list before you take a UPCS integration live. Most of it comes down to one rule: the API key is a secret and belongs on the server.

Checklist

1. Keep the key on the server. It must not appear in page source, front-end bundles, mobile apps or public repositories. The page receives only a session token. See create a map session.
2. Store it as a secret. Use environment variables or your platform's secret storage, not source files.
3. Register only the origins you need. Use https for live sites and add http://localhost:5173 only for development. See manage allowed origins.
4. Use a separate key per site and environment. A leak is then easy to contain. See naming and separating keys.
5. Keep session lifetimes short. Use the default or a smaller ttl; see session expiry.
6. Protect your session endpoint. If your server issues session tokens to pages, make sure only the pages that should have a map can request one.
7. Do not trust the browser result blindly. Data from onSelect comes from the client. Re-check important codes on the server by resolving the coordinates again with server-to-server resolve.
8. Handle errors without leaking details. Log the code and message, never the key, and give users a short message. See error codes explained.
9. Watch the request limit. Unexpected spikes can indicate misuse. See handle the rate limit.
10. Be ready to revoke. Know how to disable or delete a key and replace it quickly.

If a key is exposed

1. Generate a new key.
2. Update your server configuration or plugin settings.
3. Disable or delete the exposed key.
4. Review the traffic that used it.

Removing an origin or disabling a key immediately stops sessions that depend on it, which limits the window of misuse.