Skip to main content

Key security

Unusual activity​

Hometown compares the traffic of each key with its own past week. It flags a key in three cases:

  • It spends far more credits than usual in an hour.
  • It makes far more calls overnight than usual.
  • Half or more of its calls in the last 15 minutes are refused.

What happens next depends on the environment:

  • By default, a flagged test key pauses on its own, and the account owner gets an email with the reason.
  • A live key keeps working. The flag is recorded, and the Hometown team reviews it.

A paused key answers 403 with the code api_key_paused.

Resume a key​

If the activity was yours, open the dashboard and select Resume. If it was not, revoke the key and create a new one.

Password check in the dashboard​

Creating, rotating, revoking or resuming a key asks for your password when it was not confirmed in the last 10 minutes. An account made with Google or Apple must set a password first, with Forgot your password on the sign-in page.

Two-factor sign-in​

Turn on two-factor sign-in in your account settings. After your password, you type a code from an authenticator app. Keep the eight recovery codes the dashboard shows when you turn it on. Each one signs you in once.

Last updated on