Keeping keys safe
Where keys belong, what to do when one leaks, and good habits for teams and companies.
- Can I call the API straight from my website's JavaScript?Technically CORS allows it, but never ship a key in front-end code. Call Clatter Labs from your server instead.FAQ
- Can I put an API key in my mobile or desktop app?No. Keys in apps you distribute can be extracted. Route requests through your own server, which holds the key.FAQ
- Can I share my API key with a teammate?Better not. Invite them to your team instead, so they use their own account and keys on your plan and credits.FAQ
- How do I keep my API keys secret?Keep keys on servers, never in front-end code, apps, public repos or screenshots. Use secret stores and minimal permissions.Explainer
- How do I stop my API key from appearing in my app's logs?Never log full request headers. Redact Authorization and anything starting with clsk_, and log only error codes and request ids.FAQ
- How do I use an API key safely in CI/CD?Store the key in your CI system's secret settings, give it minimal permissions and a dedicated name, and never echo it.How-to
- How often should a company rotate API keys?Clatter Labs doesn't force a schedule. Use key expiry (30 days to 1 year) and rotate when people leave or a leak is suspected.FAQ
- I accidentally committed an API key to Git. What now?Revoke the key first, then remove it from the repository and its history. Deleting the file alone isn't enough.Troubleshooting
- Is it safe to paste my API key into an AI chat or coding assistant?No. Never paste keys into chats, prompts or tickets. Use environment variables so tools can use a key without seeing it.FAQ
- My app lets other people use the API through my key. What am I responsible for?Your key acts for your account: you pay for your end users' usage and their text counts against you under the abuse policy.Explainer
- What permissions should a key have?Only the ones it needs. A dashboard needs runs:read and account:read; a chat app needs only models:invoke.Explainer
- What should I do if my API key leaked?Revoke the key immediately, create a replacement, check Logs and your credits for unexpected use, then find the leak.How-to
- Where should I store my API keys?Use a secret manager, your hosting platform's secret settings or environment variables. Never hard-code keys.FAQ
- Why should each service have its own API key?Separate keys keep Logs readable, let you revoke one service without breaking others, and limit damage if one leaks.Explainer
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.