> For the complete documentation index, see [llms.txt](https://docs.luganodes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.luganodes.com/rpc/security.md). # Security How keys are protected and how to handle them well ### Key handling best practices * Store the endpoint URL in environment variables or a secrets manager, never in source code or client side bundles. * Use separate apps for production, staging and development, so a leaked development key never touches production and each environment's usage is visible on its own. * Set the domain whitelist for browser use and the IP allowlist for backend use, and scope the key with the allowed methods list where possible. See [security and access controls](/rpc/platform-guide/apps-endpoints-and-api-keys.md). * Rotate the key immediately if you believe it has been exposed, and whenever someone with access leaves your team. Rotation revokes the old key within seconds. ### How keys are protected * Keys are encrypted at rest through a key management service and authenticated at the gateway on every request. * Role based access control ensures only the appropriate members can view or manage keys. The Billing role never sees endpoint URLs or keys. * Keys never appear in app lists in the dashboard: They are revealed only on the app page, and every reveal and rotation is recorded. Luganodes will never ask for your API key. Report anything suspicious to .