# Key Security — AunuCore

> How to store, rotate and protect your AunuCore API key, with a built-in exposure checklist.

Source: https://ai.aunuhost.bond/keys

Security

# Protecting your API key

Your key carries your plan, your quota and your bill. Treat it like a password.

### Self-check

Tick everything that is true today.

---

—

## Where to store it

- **Environment variables** on your server, injected at deploy time.
- **A managed secret store** if your platform offers one.
- **Never** in source control, even a private repository.
- **Never** in browser JavaScript, mobile apps or desktop binaries — anyone can read them.

## The safe pattern

Browsers should talk to your backend; only your backend talks to AunuCore.

```
<span class="c">// your server — the key never leaves this process</span>
app.post(<span class="s">"/api/ask"</span>, <span class="k">async</span> (req, res) => {
  <span class="k">const</span> r = <span class="k">await</span> fetch(<span class="s">"BASE/chat/completions"</span>, {
    method: <span class="s">"POST"</span>,
    headers: {
      <span class="s">"Authorization"</span>: <span class="s">`Bearer ${process.env.AUCORE_KEY}`</span>,
      <span class="s">"Content-Type"</span>: <span class="s">"application/json"</span>,
    },
    body: JSON.stringify({ model: <span class="s">"aucore-router-auto"</span>, messages: req.body.messages }),
  });
  res.json(<span class="k">await</span> r.json());
});
```

Add your own authentication and rate limiting to that route, otherwise strangers can spend your quota through it.

## Rotating a key

1. Open your [dashboard](https://ai.aunuhost.bond/client).
2. Press **Rotate key** and copy the new value.
3. Update your environment variables and redeploy.

Rotation takes effect immediately — the previous key stops working the moment the new one is issued, so deploy quickly to avoid a gap.

## Signs of a leak

- Requests in your analytics at hours you do not operate.
- Models you never call appearing in your model split.
- Sudden `429` errors while your own traffic is normal.
- Daily budget draining far faster than usual.

If you see any of these, rotate first and investigate afterwards. Rotation is free and instant.

## Extra safety nets

- Set `max_tokens` on every request so a runaway loop cannot generate unbounded output.
- Keep a per-user rate limit in your own application, in front of AunuCore.
- Watch your dashboard's daily meter; it turns amber above 70% and red above 90%.
- Use a separate key for staging if AunuCore has issued you more than one account.

---

Questions about a suspected compromise? [Contact support](https://ai.aunuhost.bond/support) — mention only the last four characters of the key.