FileSwitchFileSwitch

Best Practices & Security

Keep your integration fast, safe, and reliable.

Recommendations

  • Store API keys securely. Keep them in environment variables or a secret manager, never in client-side code or repositories. The full key is only shown once.
  • Download outputs promptly. Converted files are retained temporarily and cleaned up automatically.
  • Respect rate limits. Honor HTTP 429 and the Retry-After header with exponential backoff.
  • Watch your credit balance. Poll GET /credits/balance and handle HTTP 402 gracefully by prompting for a top-up or upgrade.
  • Rotate keys. Revoke a key and create a new one if it is ever exposed or when a service is decommissioned.
  • Set key expiries. Use expiresInDays for temporary or CI credentials so they cannot outlive their purpose.
  • Pagination. History and transactions default to page size 20 (max 50). Use the meta response to page through results.

Security & compliance

  • All traffic is encrypted in transit (HTTPS).
  • Uploaded and converted files are auto-deleted after a short retention period.
  • API keys are stored as one-way hashes — the plaintext is never recoverable.
  • Conversions are scoped to your account and cannot be read by other accounts.