Security best practices

An API key is a credential — if it leaks, others can spend your balance. Follow these practices.

Keep it in a server-side env var

Don't hard-code the key in source. Use an environment variable:

# .env (do not commit)
NODARYX_API_KEY=sk-nodaryx-xxxxxxxxxxxxxxxx

const apiKey = process.env.NODARYX_API_KEY;

Don't commit it to GitHub

• Add .env to .gitignore
• If you commit one by accident, delete the key and create a new one immediately (removing the file from history alone isn't enough — the key may already be scraped)

Don't put it in frontend code

Anything in the browser is visible to users. Never call models directly from the frontend with your key — proxy through your own backend and keep the key server-side.

CI/CD

Inject NODARYX_API_KEY via your CI/CD platform's encrypted secret mechanism; never write it in plaintext in pipeline config.

If a key leaks

1. Delete the leaked key on the platform API Keys page
2. Create a new key
3. Update everywhere it's used (env vars, CI secrets, tool configs)

Next steps

• Key lifecycle
• Permissions & model scope