> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gloo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Security

> Best practices for storing, using, and replacing Gloo AI API keys: keep keys on the server, out of source control and logs, and replace any key that may be exposed.

Your API key authenticates every request your application makes and spends your [organization's](https://docs.gloo.com/getting-started/glossary.md#organization) credits. Anyone who has it can do the same. **Treat your API key like a password.**

This guide covers how to:

* store the key outside your code
* keep it on the server, never in a browser or mobile app
* use it safely at runtime
* replace a key that may be exposed

To create a key, see [Generate API Keys](https://docs.gloo.com/studio/manage-api-credentials.md). To send it in requests, see the [Authentication tutorial](https://docs.gloo.com/tutorials/authentication.md).

> [!NOTE]
>
> **Gloo Code** doesn't use API keys. You sign in to it from the browser, and it manages its own credential for you. See the [Gloo Code installation guide](https://docs.gloo.com/gloocode/installation.md).

## Store the Key Outside Your Code

* **Copy the key when you create it.** It is shown only once. After that, Studio displays only the obfuscated value (for example, `sk_...3456`).
* **Never hardcode your API key in source code.** Load it from an environment variable such as `GLOO_API_KEY`, or from secure credential storage.
* **Add `.env` files to your `.gitignore`**, and never commit the key to source control.
* **Use a secrets manager in production** rather than plaintext `.env` files.

## Keep the Key on the Server

Browser and mobile code can be read by anyone who uses your app. A key in that code is a published key.

* **Never expose `GLOO_API_KEY` to frontend code.** Your backend reads the key from the environment and sends it as `Authorization: Bearer {GLOO_API_KEY}` on every API call.
* **Put a server-side proxy between your frontend and Gloo AI.** Your frontend calls your own backend, and the backend calls Gloo AI. Browsers also block direct calls from browser JavaScript to `platform.ai.gloo.com`, so a proxy is required for browser apps anyway. The [Streaming tutorial](https://docs.gloo.com/tutorials/completions-streaming.md) builds one.
* **Check generated code.** When an AI coding assistant writes your app, confirm the key is loaded from environment variables and used only in the backend. See [AI-Assisted Development](https://docs.gloo.com/tutorials/vibe-coding.md).

## Use the Key Safely at Runtime

* **Load the key once at startup** and reuse it for every API call.
* **Keep the key only in backend memory.**
* **Never log the API key**, and log authentication events without it.
* **Always use HTTPS** for API calls, with a secure HTTP client configuration.
* **Don't retry a `401`.** It means the key is missing, invalid, expired, or revoked, and a static key won't become valid on retry. Verify `GLOO_API_KEY` is set correctly instead. See [Error Handling and Retries](https://docs.gloo.com/best-practices/error-handling-and-retries.md#which-errors-to-retry).

## Replace a Key That May Be Exposed

Delete any key that is compromised or no longer used, then create a replacement and update your applications. A deleted key stops working shortly after you delete it.

* **Know who can delete a key.** Any member of your organization can create an API key. A key can be deleted by the person who created it or by an organization **Admin**.
* **Update every place the key is configured**, including editor or tool settings that hold a custom provider key. See [SDKs and Libraries](https://docs.gloo.com/api-guides/sdks-and-libraries.md).
* **Check key status in Studio.** A key doesn't time out like a short-lived access token, but it stops working if it passes an expiration date set for it or is revoked. Each key is **Active**, **Inactive**, or **Expired**; only an active key works. See [Key Status and Deleting Keys](https://docs.gloo.com/studio/manage-api-credentials.md#key-status-and-deleting-keys).

## Summary

| Practice | Minimum viable version |
| - | - |
| Store | Environment variable or secrets manager; `.env` in `.gitignore` |
| Scope | Backend only; frontend calls your proxy |
| Runtime | Load once, never log, HTTPS only |
| Errors | Don't retry `401`; fix the key |
| Exposure | Delete the key, create a replacement, update every app |

## Next steps

> **[Generate API Keys](https://docs.gloo.com/studio/manage-api-credentials.md)**
>
> Create, check, and delete keys in Gloo AI Studio.

> **[Authentication Tutorial](https://docs.gloo.com/tutorials/authentication.md)**
>
> Send your key in API calls, in six languages.

> **[Error Handling and Retries](https://docs.gloo.com/best-practices/error-handling-and-retries.md)**
>
> Which errors to retry, and which to fix.

> **[Get Help](https://docs.gloo.com/getting-started/support.md)**
>
> Common key problems and how to reach support.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.