Protecting your API key

Your key carries your plan, your quota and your bill. Treat it like a password.

Where to store it

• Environment variables on your server, injected at deploy time.
• A managed secret store if your platform offers one.
• Never in source control, even a private repository.
• Never in browser JavaScript, mobile apps or desktop binaries — anyone can read them.

The safe pattern

Browsers should talk to your backend; only your backend talks to AuCore.

// your server — the key never leaves this process
app.post("/api/ask", async (req, res) => {
  const r = await fetch("BASE/chat/completions", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.AUCORE_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ model: "gpt-5.4-mini", messages: req.body.messages }),
  });
  res.json(await r.json());
});

Add your own authentication and rate limiting to that route, otherwise strangers can spend your quota through it.

Rotating a key

1. Open your dashboard.
2. Press Rotate key and copy the new value.
3. Update your environment variables and redeploy.

Rotation takes effect immediately — the previous key stops working the moment the new one is issued, so deploy quickly to avoid a gap.

Signs of a leak

• Requests in your analytics at hours you do not operate.
• Models you never call appearing in your model split.
• Sudden 429 errors while your own traffic is normal.
• Daily budget draining far faster than usual.

If you see any of these, rotate first and investigate afterwards. Rotation is free and instant.

Extra safety nets

• Set max_tokens on every request so a runaway loop cannot generate unbounded output.
• Keep a per-user rate limit in your own application, in front of AuCore.
• Watch your dashboard's daily meter; it turns amber above 70% and red above 90%.
• Use a separate key for staging if AuCore has issued you more than one account.

Questions about a suspected compromise? Contact support — mention only the last four characters of the key.