Reference
Security
Protect account access, credentials, and the tools that consume model output.
API keys
- Keep secrets on the server and out of source control, browser bundles, and logs.
- Use separate keys and spending limits for each application.
- Rotate keys periodically and revoke an exposed key immediately.
- Use HTTPS for production API requests.
Account access
Enable account MFA and keep recovery credentials secure. Account-management operations use an authenticated web session; administrator operations require their own role and MFA checks.
Model output and tools
Treat generated content and tool arguments as untrusted input. Validate schemas and permissions before executing an action. The gateway does not execute model-requested tools for you.