Use an API gateway with clear security boundaries
Security is part of API pricing and reliability. This overview explains the practical controls developers should verify before connecting production workloads.
Key and account hygiene
- Keep router.cheap keys in environment variables or a secret manager, never in browser bundles or Git.
- Use separate keys per environment and revoke or rotate them when access changes.
- Apply least privilege and monitor usage for unexpected spikes.
Request and infrastructure boundaries
Use HTTPS, explicit timeouts, bounded retries, and request IDs. Avoid logging full prompts, credentials, or provider responses that contain personal data. Treat third-party clients and plugins as separate trust boundaries.
Before production
Read the data-retention terms, test failure behavior, review the service status, and document an incident contact. Security controls do not make a workload automatically appropriate for every model provider.
Frequently asked questions
Should keys be used in frontend JavaScript?
No. Call the API from your backend or a trusted server-side worker and keep the key outside public bundles.
Does compatibility mean data is retained?
Compatibility describes the protocol, not retention. Read the current data-retention terms and ask support for requirements not covered there.
Where do I report an incident?
Use the support and account channels available in the authenticated dashboard and include request IDs without sending secrets.