Protect Credentials and Investigate Usage

An API token and unredeemed CDKs must be protected from public exposure.

Credential Storage

An API token authenticates requests. Store it as you would a password and do not share it publicly. See Quick Start for creation and copying instructions. Keep unredeemed CDKs private. Do not display unredeemed CDKs in public documentation, chat records, or screenshots.

Prevent credential exposure

Never hardcode your API token or unredeemed CDKs into frontend code, static bundles, public repositories, or build artifacts, and ensure application logs do not record credentials. Additionally, credential-bearing import links carry the same exposure risk and must not be shared.

Preventing Code and Configuration Leaks

When writing code examples or sharing documentation, always use obvious placeholders (for example, sk-your-token). Never use a real API token. Local client configuration files may store an API token. Before committing or sharing project files, review the included files to confirm they contain no API token or credential-bearing import link.

Sending Requests

Configure your API token only in a client you trust. Send API requests only to the HTTPS addresses shown in the guide for your client or under API Access Routes. If you use CC Switch, generate import links only from the CC Switch guide.

Investigating Unexpected Usage

If you suspect credential exposure, immediately stop using the exposed credential and ensure it is invalidated. After updating affected configurations, review the usage log for requests you do not recognize. See Account and Billing for a description of the recorded fields.