Authentication and Key Security
Understand Bearer token authentication, environment isolation, key rotation, and exposure response.
APIQIK uses Bearer tokens. Each request must include a valid API key in the Authorization header.
Standard authentication
POST /v1/chat/completions HTTP/1.1
Host: api.apiqik.com
Authorization: Bearer YOUR_APIQIK_API_KEY
Content-Type: application/jsonUse one ASCII space between Bearer and the key. A missing, invalid, or revoked key returns 401 Unauthorized.
Backend proxy pattern
Browser or app without a platform key → your backend for authentication and quota checks → APIQIK with a Bearer API key.
The frontend calls your backend first. Your backend authenticates the user, checks permissions and quota, then sends the request with the APIQIK key. This prevents users from extracting the platform key directly.
Environment isolation
| Environment | Recommendation | Purpose |
|---|---|---|
| Local development | Use a personal development key in a local environment file and ignore that file. | Limit the impact of exposure. |
| Test or staging | Use an independent key and budget; never reuse production keys. | Prevent load tests or faulty scripts from consuming production balance. |
| Production | Inject keys through a secrets manager, restrict read access, and audit access. | Enforce least privilege and traceable rotation. |
Act immediately if a key leaks. Revoke it, create a replacement, inspect request records and unusual spending, and identify how it entered logs, build artifacts, or repository history.