Your API keys are the gateway to your Cathopic account. Keeping them secure prevents unauthorized access and protects against billing fraud.
The golden rule: Keep keys secret
Treat your API keys like passwords. Common mistakes to avoid:
Hardcoding keys directly in source code
Committing keys to Git or other version control
Using keys in client-side JavaScript or mobile apps
Sharing keys via email, Slack, or messaging apps
Storing keys in public locations (public repos, wikis, etc.)
Use environment variables
Store keys in environment variables instead of code:
// .env file (add to .gitignore!)
CATHOPIC_API_KEY=sk_live_abc123xyz789...
// Your code
require('dotenv').config();
const apiKey = process.env.CATHOPIC_API_KEY;This separates sensitive data from your codebase and makes key rotation easier.
Server-side only
API calls must happen from your backend servers, not browsers or mobile apps. If users need access to Cathopic resources:
Create a backend endpoint that uses your API key
Your frontend calls YOUR endpoint, not Cathopic directly
Your server validates the user request before calling Cathopic
Restrict by IP (if possible)
Some infrastructure allows IP whitelisting. If your API calls come from known IPs:
Configure firewall rules to limit outbound access
Use dedicated service accounts with minimal permissions
Monitor access logs for unusual activity
If a key is compromised
If you suspect a key has been exposed:
Generate a new API key immediately
Update your application with the new key
Delete the compromised key
Review usage logs for suspicious activity
Contact support if you see unauthorized charges
Manage your keys securely at Settings → API.
