Five steps, in this order
Your account holds two kinds of secrets: the password you sign in with, and the keys and passwords your apps use. These five steps protect both. Each one has its own page that says what changes and what you have to update afterwards.
1. Turn on two-factor authentication
Required on every Opensolr account. Until it is on, signing in takes you to the two-factor page. A stolen password alone then no longer opens your account.
2. Generate a new master API key
Anyone who ever saw your master key, in a config file, a script or an old laptop, can use it until you replace it. The old key stops working the moment you generate a new one, so every app that uses it needs the new one.
3. Change the password of your indexes
Every index starts with your master key as its password, and a new key does not change it. Give each index you use its own password, then update the apps that search it.
4. Give each app a scoped key
A scoped key only does what one app needs, on the indexes you pick, until a date you choose. If it leaks, you revoke that one key and nothing else stops.
5. For advanced setups: limit addresses per handler
IP rules decide which addresses may search, write or suggest on an index. For example: searches from everywhere, writes only from your server.