A practical guide to API keys
Separate integrations, protect credentials, and revoke access with confidence.
Give each integration its own key
A named key makes request history easier to understand. Separate development and production integrations so you can revoke one without interrupting the other.
Store keys on the server
Keep API credentials in a secret manager or server environment. Your frontend should call your own backend, which then calls ModelMesh.
Rotate deliberately
Create a replacement, update your application, confirm requests work, and revoke the old key. If a key is exposed, revoke it promptly.
Review usage
Review request logs and token costs regularly. A revoked key can no longer authorize new requests; historical records remain available.