API Key Security Best Practices

Treat every IPRout key as a secret. Keep it in server-side environment variables or a secret manager, use separate named keys for independent workloads, apply paid-plan CORS restrictions where appropriate, choose a bounded Pro cap, monitor usage, and rotate or revoke credentials promptly.

Last updated August 10, 2026

Where should API keys live?

Keys belong in server-side secrets, not source files, mobile applications, screenshots, support tickets, or public browser bundles.

Which controls reduce exposure?

Use narrow origin allowlists for intended browser origins, independent keys for separate systems, and a Pro cap sized to expected traffic.

What should never be logged?

Redact Authorization, X-API-Key, raw secret values, and URLs if a credential was accidentally placed in a query string.