# Keep your API key safe

Where your key belongs, and what to do if it leaks.

Anyone holding your key can use your access, so treat it like a password.

## Where the key belongs

- **On your server.** Read it from an environment variable or your platform's secret store.
- **In the `X-API-Key` header.** Never put it in a URL, because URLs end up in logs and browser history.
- **Out of your code.** Don't commit it, print it or write it to logs.

## Call the API from your server

Don't ship the key in browser or mobile code, where anyone can read it. Browser calls from other websites don't work anyway, because API responses have no CORS headers. Have your frontend call your own server, and have your server call Quadruper.

## Working with AI agents

Don't paste the key into a chat with an agent. Set it in the environment and have the code read it there. See [Integrate with AI](../start/integrate-with-ai.md).

## If your key leaks

Email [contact@sieitz.com](mailto:contact@sieitz.com) as soon as you can, and include your client identifier, but never the key itself. Staff can issue you a new key and revoke the old one.

Asking for a new key before the old one stops working lets you switch over without an outage.

## If your key stops working

`401 unauthorized` means the key is missing or isn't valid. A key may have an expiry date set when it was issued. Check that you're sending the right key, then contact us if it still fails.