Skip to main content
OpenAI-compatible endpoints use Authorization: Bearer <API_KEY>. Anthropic uses x-api-key, and Gemini uses x-goog-api-key. Always use HTTPS.
Never expose an API key in browser code, mobile bundles, public repositories, logs, or screenshots. Store it in a server-side environment variable or secret manager.
If a key is exposed, revoke it immediately in Key management.