Security

How keys are protected and how to handle them well

Key handling best practices

• Store the endpoint URL in environment variables or a secrets manager, never in source code or client side bundles.

• Use separate apps for production, staging and development, so a leaked development key never touches production and each environment's usage is visible on its own.

• Set the domain whitelist for browser use and the IP allowlist for backend use, and scope the key with the allowed methods list where possible. See security and access controls.

• Rotate the key immediately if you believe it has been exposed, and whenever someone with access leaves your team. Rotation revokes the old key within seconds.

How keys are protected

• Keys are encrypted at rest through a key management service and authenticated at the gateway on every request.

• Role based access control ensures only the appropriate members can view or manage keys. The Billing role never sees endpoint URLs or keys.

• Keys never appear in app lists in the dashboard: They are revealed only on the app page, and every reveal and rotation is recorded.

Luganodes will never ask for your API key. Report anything suspicious to [e-mail].