Skip to main content
  • Store keys in a secrets manager or environment variables, never in code, logs, or prompts.
  • Keep keys on your server. Never ship a key in a browser bundle, mobile app, or public repository. Browser apps should call your backend, and your backend calls us.
  • Use one key per service with the narrowest scopes, an expiry, and an IP allowlist where the caller’s addresses are fixed.
  • Cap spend for scripts and agents with the Agent preset, which sets a daily credit budget and a per-request maximum.
  • Rotate keys on a schedule with an overlap, so you can deploy the new secret before the old one stops working.
  • If a key may have leaked, revoke it immediately (or rotate it with no overlap). Revocation takes effect within about 5 seconds.
  • Always call the API over HTTPS.
Workspace admins can require an IP allowlist on every key, set a maximum key lifetime, and allow or block keys that never expire. Report vulnerabilities to sales@hyperdash.com.