> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antsfield.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Retrac secures the API and how to integrate safely.

## Transport and storage

* All API traffic must use **TLS** (`https://api.retrac.co`).
* Store API keys in environment variables or a secrets manager — never in frontend bundles, mobile apps, or public config files.
* **Rotate keys** immediately if a key may have been exposed. Delete the old key after deploying the new one.

## Least privilege

* Prefer **restricted keys** (`retrac_` prefix) over full-access keys.
* Grant only the scopes your integration needs. A read-only reporting job should use `apis.read`, not `apis.all`.
* Use separate keys per environment (staging vs production) and per integration.

## Workspace isolation

* Every request is scoped to a **single workspace**. Keys cannot access workspaces the creating user does not belong to.
* Responses contain only data for the authenticated workspace. Cross-tenant access is not supported by design.

## Location access

Members with **location restrictions** only see and modify inventory for assigned locations — including via API keys created by that member. Owners always have full workspace access.

## Rate limiting

API keys are rate limited per key. See [Rate limits](/api-reference/rate-limits). Honor `429` responses and the `Retry-After` header.

## What the public API does not expose

The documented API surface intentionally excludes:

* Admin, cron, billing, and webhook callback routes
* User session, password, and OAuth endpoints
* SAML/SCIM provisioning endpoints (configured in the dashboard, not via public REST)
* Internal AI, support, and feedback endpoints

Do not rely on undocumented routes — they may change without notice and are not subject to versioning guarantees.

## Error responses

Errors return JSON with a machine-readable `code` and **no stack traces** or internal paths. See [Errors](/api-reference/errors).

## Reporting issues

If you discover a security concern, email [support@retrac.co](mailto:support@retrac.co?subject=Security%20report) with reproduction steps. Do not disclose publicly before we respond.