Data and key security

Keep credentials on your own device or server

Store API keys in environment variables or your secret manager. Avoid embedding them in browser bundles, public repositories, shared configuration files or support screenshots.

Use separate keys for separate applications and revoke exposed keys promptly. Review request logs for unexpected usage after replacing a key.

Review data handling before sending content

API requests are processed by the gateway and the selected upstream provider. Usage records and diagnostic records serve different purposes. Review Trust & Security and the Privacy Policy before sending sensitive content.

When contacting support, share the request ID and a redacted error first. Include only the information needed to investigate the issue.