Authentication

MoonNexAI APIs use an API key for authentication.

Authorization: Bearer <MOONNEXAI_API_KEY>

Security requirements

• Never expose an API key in frontend source, public repositories, screenshots or logs.
• Use <MOONNEXAI_API_KEY> as the placeholder in documentation.
• Online API explorers must not store users' API keys on the documentation server.
• Rotate an exposed key immediately in the MoonNexAI console.

Request header

Authorization: Bearer <MOONNEXAI_API_KEY>

Do not place an API key in a URL query string, public browser page or distributed client application.

Rotation

• Create separate keys for production, local development and temporary tests.
• Treat a key appearing in a chat, log, screenshot or public repository as exposed.
• Update server environment variables after rotation and revoke the old key.
• Always use <MOONNEXAI_API_KEY> in public examples; avoid fake values that resemble real keys.