Keep your API keys safe
An API key lets anyone who holds it spend your organization’s plan allowance and credit. Treat it like a password: keep it on your server, give each service its own key, and revoke any key that may have been seen by someone else.
Where a key should live
- In a secret store or password manager.
- In an environment variable on the server that runs your code, read at runtime.
- In your hosting platform’s encrypted settings for secrets.
Where a key should never go
- Browser JavaScript, mobile apps or desktop apps you ship to users. Anything sent to a user’s device can be read.
- Source code or config files committed to a repository, public or private.
- Chat messages, support tickets, screenshots or screen shares. Syntic support will never ask for your key; your Organization ID and a request ID are enough.
- Shared documents or wiki pages.
If your app needs Syntic in the browser, send requests through your own backend, which holds the private key and decides what each user may do.
⚠️
An allowed-origins list does not make it safe to put a private key in a web page. Anyone can copy it and call the API from a server.
Good habits
| Habit | Why it helps |
|---|---|
| One key per service and environment | Revoking one leaves the others running, and Last used shows which service is active |
| Clear names | ”billing-api-prod” tells a teammate what breaks if it’s revoked |
| Rotate on a schedule and when people leave | Limits how long a copied key stays useful |
| Set a monthly spend limit | Caps the damage a leaked key can do. See The Billing overview page |
| Turn on two-step verification | Protects the account that can create and see keys |
| Review Billing Details now and then | Unknown spikes by model or day can signal misuse |
How Syntic protects keys
Syntic stores only a one-way fingerprint of each key and a short prefix for display. The full key exists only in the dialog you see once, at creation. Creating a key also requires your second-factor code when two-step verification is on.
If a key leaks
- Revoke it now: API Keys → Revoke. It stops working instantly. See Revoke an API key.
- Create a replacement and deploy it.
- Check Billing Details for usage you don’t recognise.
- If you see charges you didn’t make, email support@syntic.ai with your Organization ID and the dates.
Related
Was this page helpful?