Security checklist

One key per tool, read-only where the tool only reads.
Keep keys and the webhook secret in server-side settings or a secrets manager. Never in website code, links, spreadsheets anyone can open, chats or email.
Turn a key off the moment it may be exposed. Make a new one before a key's 90 days run out.
Webhook endpoints: HTTPS only, check X-Signature on every request, reject old timestamps, answer fast.
Store customer contact details only as long as you need them for the job and your records, and limit who can see them.
Make sure your software provider has agreed in writing to use lead data only for you. See the API Terms.
Report anything suspicious through Help in the app.