API key security

Your key is a bearer credential inside the URL — treat it like a password.

• Never ship a key in frontend code. Anything in the browser bundle is public; put the key behind your own backend proxy instead.
• One key per app / environment. Blast radius stays small and usage stays attributable (per-key charts on the dashboard).
• Rotate a leaked key. Use Rotate on the API Keys page, copy the replacement secret, and update your app. The previous secret stops working after the gateway refreshes.
• Watch usage. Investigate unexpected traffic. Disable or rotate a key if it may have been exposed.
• Protect requests in transit and logs. Use HTTPS/WSS in production and redact key-bearing URLs from logs, error reports and shared screenshots.
• Shared machines: the docs Try-it panel never stores a pasted key — it is discarded when you leave the page.