How do I use the Agent API safely in production?
A short checklist:
- Keys on the server only, in a secret manager. Never in front-end code or public repos.
- One key per integration, with only the permissions it needs.
- Filter end-user input: your account is responsible for it.
- No secrets in
input: connect services to your account instead. - Review outputs like code from a pull request before shipping.
- Handle errors: stop on
402, back off on429, don't retryaccount_suspended. - Watch the abuse warning header and act on it.
Learn more#
Related articles
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.