API Key Security

Your API key authenticates every request your application makes and spends your organization’s credits. Anyone who has it can do the same. Treat your API key like a password. This guide covers how to:

• store the key outside your code
• keep it on the server, never in a browser or mobile app
• use it safely at runtime
• replace a key that may be exposed

To create a key, see Generate API Keys. To send it in requests, see the Authentication tutorial.

​

Store the Key Outside Your Code

• Copy the key when you create it. It is shown only once. After that, Studio displays only the obfuscated value (for example, sk_...3456).
• Never hardcode your API key in source code. Load it from an environment variable such as GLOO_API_KEY, or from secure credential storage.
• Add .env files to your .gitignore, and never commit the key to source control.
• Use a secrets manager in production rather than plaintext .env files.

​

Keep the Key on the Server

Browser and mobile code can be read by anyone who uses your app. A key in that code is a published key.

• Never expose GLOO_API_KEY to frontend code. Your backend reads the key from the environment and sends it as Authorization: Bearer {GLOO_API_KEY} on every API call.
• Put a server-side proxy between your frontend and Gloo AI. Your frontend calls your own backend, and the backend calls Gloo AI. Browsers also block direct calls from browser JavaScript to platform.ai.gloo.com, so a proxy is required for browser apps anyway. The Streaming tutorial builds one.
• Check generated code. When an AI coding assistant writes your app, confirm the key is loaded from environment variables and used only in the backend. See AI-Assisted Development.

​

Use the Key Safely at Runtime

• Load the key once at startup and reuse it for every API call.
• Keep the key only in backend memory.
• Never log the API key, and log authentication events without it.
• Always use HTTPS for API calls, with a secure HTTP client configuration.
• Don’t retry a 401. It means the key is missing, invalid, expired, or revoked, and a static key won’t become valid on retry. Verify GLOO_API_KEY is set correctly instead. See Error Handling and Retries.

​

Replace a Key That May Be Exposed

Delete any key that is compromised or no longer used, then create a replacement and update your applications. A deleted key stops working shortly after you delete it.

• Know who can delete a key. Any member of your organization can create an API key. A key can be deleted by the person who created it or by an organization Admin.
• Update every place the key is configured, including editor or tool settings that hold a custom provider key. See SDKs and Libraries.
• Check key status in Studio. A key doesn’t time out like a short-lived access token, but it stops working if it passes an expiration date set for it or is revoked. Each key is Active, Inactive, or Expired; only an active key works. See Key Status and Deleting Keys.

​

Summary

​

Next steps