Authentication security

Treat a KosCompute API key as a password.

• Send it only over HTTPS in Authorization: Bearer or x-api-key.
• Keep it in a secret manager or protected server environment variable.
• Never put it in query strings, frontend bundles, mobile binaries, screenshots, issue reports, or source control.
• Use separate keys for services or environments when available.
• Rotate a key immediately if exposure is suspected.
• Apply model, request-rate, and concurrency restrictions appropriate to the application.

Do not forward end-user-provided headers directly to the API. Construct a small allowlist of upstream headers and inject the server-side credential yourself.

For logs, retain the server request ID and non-secret operational fields. Redact both Authorization and x-api-key before an error object reaches logging or tracing middleware.