API Key Security

Use one key per application and environment, for example local-development, production-backend, cc-switch, and codex-cli. This isolates logs, quota, and revocation.

Available controls

Control	Recommended use
Expiration	Temporary tests and short projects
Key quota	Cap the maximum loss from one key
Model restriction	Allow only models required by the application
IP allowlist	Restrict a server key with a stable public egress IP
Group	Control model routes and multipliers

Never put keys in frontend code, mobile packages, public repositories, issue trackers, URLs, screenshots, or unredacted logs. A browser application should call your authenticated backend, which stores the key and enforces per-user limits.

If a key leaks

1. Disable or delete it immediately from API Keys.
2. Check usage logs for the time, model, and unexpected charges.
3. Create a replacement with tighter quota, model, and IP limits.
4. Update the deployment secret and restart the application.
5. Remove the old value from Git history, logs, artifacts, and attachments.

Deleting a public file does not invalidate a leaked key. Rotation is mandatory.

For planned rotation, create and verify the new key first, switch the application, confirm new-key traffic, and only then revoke the old key. Logs may include a short key suffix for identification but must never contain the complete value.