# Authentication security

Store, transmit, rotate, and scope API keys safely.

Treat a KosCompute API key as a password.

- Send it only over HTTPS in `Authorization: Bearer` or `x-api-key`.
- Keep it in a secret manager or protected server environment variable.
- Never put it in query strings, frontend bundles, mobile binaries, screenshots, issue reports, or source control.
- Use separate keys for services or environments when available.
- Rotate a key immediately if exposure is suspected.
- Apply model, request-rate, and concurrency restrictions appropriate to the application.

Do not forward end-user-provided headers directly to the API. Construct a small allowlist of upstream headers and inject the server-side credential yourself.

For logs, retain the server request ID and non-secret operational fields. Redact both `Authorization` and `x-api-key` before an error object reaches logging or tracing middleware.