# .env (never commit this file!)
FRAUD_BUSTER_API_KEY=fb_live_your_key_here
FRAUD_BUSTER_SECRET_KEY=your_secret_key_here

// Load from environment
import dotenv from 'dotenv';
dotenv.config();

const client = new TxnCheckClient({
  apiKey: process.env.FRAUD_BUSTER_API_KEY!,
  secretKey: process.env.FRAUD_BUSTER_SECRET_KEY,
});

# secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: txncheck-secrets
type: Opaque
stringData:
  api-key: fb_live_your_key_here
  secret-key: your_secret_key_here
---
# deployment.yaml
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: app
          env:
            - name: FRAUD_BUSTER_API_KEY
              valueFrom:
                secretKeyRef:
                  name: txncheck-secrets
                  key: api-key

// config/api-keys.ts
export interface APIKeyConfig {
  primary: string;
  secondary?: string; // Used during rotation
}

// During rotation, try primary first, fall back to secondary
class RotatingTxnCheckClient {
  private primaryClient: TxnCheckClient;
  private secondaryClient?: TxnCheckClient;

  constructor(config: APIKeyConfig) {
    this.primaryClient = new TxnCheckClient({ apiKey: config.primary });
    if (config.secondary) {
      this.secondaryClient = new TxnCheckClient({ apiKey: config.secondary });
    }
  }

  async upiByMobile(mobile: string, options: any) {
    try {
      return await this.primaryClient.upiByMobile(mobile, options);
    } catch (error) {
      if (this.isAuthError(error) && this.secondaryClient) {
        console.warn('Primary key failed, trying secondary');
        return await this.secondaryClient.upiByMobile(mobile, options);
      }
      throw error;
    }
  }

  private isAuthError(error: any): boolean {
    return error.statusCode === 401;
  }
}

// Key with limited scope
const limitedClient = new TxnCheckClient({
  apiKey: process.env.FRAUD_BUSTER_BLOCKLIST_ONLY_KEY!,
  // This key only has access to vpa-chargeback-check
});

// Full access key for admin operations
const adminClient = new TxnCheckClient({
  apiKey: process.env.FRAUD_BUSTER_ADMIN_KEY!,
});

// middleware/api-tracking.ts
export function trackApiUsage(keyName: string) {
  return async (req: Request, res: Response, next: NextFunction) => {
    const startTime = Date.now();
    
    res.on('finish', () => {
      const duration = Date.now() - startTime;
      
      // Send to your monitoring system
      metrics.increment('fraud_buster.api_calls', {
        key: keyName,
        endpoint: req.path,
        status: res.statusCode,
        duration,
      });
    });
    
    next();
  };
}

// Example alert rule (pseudo-code)
const alertRules = [
  {
    name: 'High Error Rate',
    condition: 'error_rate > 10% over 5 minutes',
    action: 'page_oncall',
  },
  {
    name: 'Unusual Volume',
    condition: 'request_count > 3x baseline over 1 hour',
    action: 'slack_alert',
  },
  {
    name: 'Auth Failures',
    condition: 'status_401_count > 10 in 1 minute',
    action: 'page_security',
  },
];

# .git/hooks/pre-commit
#!/bin/bash

# Check for API keys
if git diff --cached | grep -E 'fb_(test|live)_[a-zA-Z0-9]+'; then
  echo "ERROR: Possible API key detected in commit"
  echo "Remove sensitive data before committing"
  exit 1
fi

# .gitignore
.env
.env.local
.env.*.local
*.key
secrets/

# Run GitLeaks before pushing
gitleaks detect --source . --verbose

#!/bin/bash
# emergency-rotate.sh

set -e

echo "🚨 Emergency API Key Rotation"

# Generate new key via API (if available) or manually in dashboard
NEW_KEY="fb_live_new_key_here"

# Update secrets manager
aws secretsmanager update-secret \
  --secret-id txncheck/api-keys \
  --secret-string "{\"FRAUD_BUSTER_API_KEY\":\"$NEW_KEY\"}"

# Force redeploy services
kubectl rollout restart deployment/my-service

# Revoke old key (via dashboard or API)
echo "⚠️ Remember to revoke the old key in the dashboard!"

echo "✅ Rotation complete"