> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure API Key Handling

> A key is full organization access, so store, isolate, cap, and rotate it.

A `z_sk_` key grants full organization-scoped access: no per-key scopes, no read-only type. Any valid key reaches the whole catalog and spends against the balance. Treat it as a password with full account access.

The server keeps only a one-way hash. You see the raw key once, at creation. Lost it? Rotate.

## Store in Secrets

* Load from the environment (`NITO_API_KEY`) or a secrets manager. Never commit it.
* Never ship a key in browser or mobile code. Route model calls through your backend.
* Never log the `Authorization` header. See [Privacy-Safe Logging](/api/features/best-practices/privacy-safe-logging).

## Isolate and Cap

* **One key per workload.** Revoke one without taking down the rest, and see from usage which workload it belongs to.
* **A spend cap on every key.** `daily` and `monthly` caps block the key until the UTC window resets; an `overall` cap expires it. A leaked key becomes a bounded liability. See [Cost Control](/api/features/best-practices/cost-control).

## Rotate

There is no edit operation: create a new key in the [developer console](/web-app/developer-console), deploy it, revoke the old one. Rotate on a schedule and immediately on suspicion.

## Who Can Manage Keys

Only `owner` and `admin` roles create, list, or revoke keys. Keep that set small and review it when people join or leave.

## Checklist

* Keys in env vars or a secrets manager, never in source or client code.
* One key per workload, each capped.
* Rotate by create-then-revoke.
* `Authorization` never logged.
* Key management limited to owner and admin.

## Related

<CardGroup cols={3}>
  <Card title="Cost Control" icon="money-bill-wave" href="/api/features/best-practices/cost-control">
    Spend caps.
  </Card>

  <Card title="Authentication" icon="key" href="/api/get-started/authentication">
    Keys and headers.
  </Card>

  <Card title="Privacy-Safe Logging" icon="signal-stream" href="/api/features/best-practices/privacy-safe-logging">
    Keep prompts and keys out of logs.
  </Card>
</CardGroup>

## Separate provisioning from inference

Keep application keys at the default `admin: false`. Store a separate admin key in your provisioning service if you automate [key creation and rotation](/api/api-reference/api-keys). Set expiry and spend caps explicitly on each new key: these are independent of the caller's settings. Creation returns the secret once at `key.token`; list responses never reveal it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.