API keys and security

An API key gives access to your TokRouter balance. Treat it like a sensitive password.

Best practices

• Create one key per application, environment, or team.
• Give it an explicit name, e.g. production-api or staging-web.
• Store it in environment variables or a secrets vault.
• Never send it in browser code, a Git repository, a public ticket, or a screenshot.
• Revoke immediately any key you suspect is compromised.

Environment variables

Create a local .env.local file and add it to .gitignore:

OPENAI_API_KEY=sk-tok-...
OPENAI_BASE_URL=https://tokrouter.mattok.ch/api/v1

In production, use the secrets manager provided by your host.

Revoking a key

Open Settings → API keys, then click Revoke. A revoked key can never be reactivated: create a new one and update your application.

Limiting the impact of a leak

Use a different key for each environment. That way, a leak from a test environment doesn't affect your production application. Regularly check the last-used date of your keys in Settings.