API keys
Also known as: API key · secret key
API keys are the secret tokens that authorize your app to call a model (or any) API.
- Treat them like passwords.
- Never hardcode in source, commit to git, or paste into chat.
- Rotate if exposed; scope them to the least access.
The LLM twist: a model that can write files or make requests is a path from a leaked key to exfiltration. Keep keys out of the model's reachable context entirely.