Use API Keys Securely
Treat your API key like a password.
Do: env vars or a secret manager · call from the backend only · restrict who can read production keys · rotate on suspicion · separate keys per environment.
Don't: frontend code · commits · screenshots, issues, chat messages · logging the full key.
The pattern
frontend → your backend endpoint → Custodian Labs API (X-API-Key) → your backend → frontend
The key never reaches the browser; your backend owns validation, logging, and retries.
Local vs production
# local
export CUSTODIAN_SDK_API_KEY="..." # SDKs
export CUSTODIAN_API_KEY="..." # raw Guardian Layer / Platform API
Production: Vercel env vars, AWS/GCP/Azure secret managers, Kubernetes Secrets — read by backend services only.
If a key leaks
Stop using it → scrub it where you can → rotate/revoke → update your backend → check usage for anything unexpected.