API Security Configuration

Protect Your API Key

The API Key is the only credential for calling the API. If leaked, your balance may be stolen. Please ensure strong security protection.

Security Best Practices

1. Do Not Hardcode Keys in Code

Do NOT Do This

api_key = "sk-abcdef123456"  # ❌ Do not write it directly in the code

Recommended Practice

import os
api_key = os.environ.get("OPENAI_API_KEY")  # ✅ Read from environment variable

2. Use a .env File to Manage Keys

# .env file (add to .gitignore)
OPENAI_API_KEY=sk-yourAPIKey
OPENAI_BASE_URL=https://fast-api.org/v1

# Use python-dotenv in Python to load
from dotenv import load_dotenv
import os

load_dotenv()
api_key = os.getenv("OPENAI_API_KEY")

3. Set Token Quotas

When creating tokens in the platform backend, it is recommended to set reasonable quota limits to prevent accidental overuse.

4. Configure IP Whitelisting

If the caller’s IP address is known, it is recommended to configure an IP whitelist in the token settings to restrict the usage scope of the Key.

5. Rotate Keys Regularly

It is recommended to regularly (e.g., every 90 days) change the API Key to reduce the risk of exposure.

6. Monitor Usage

Regularly check the platform’s usage logs and watch for abnormal usage patterns:

• Sudden increase in call frequency
• Unfamiliar IP addresses
• Unusual model calls

Handling Key Leaks

If you discover your API Key has been leaked:

1. Immediately delete the token
2. Create a new token as a replacement
3. Check usage logs to confirm if there have been abnormal calls
4. If your balance has suffered abnormal loss, contact customer support