API key security

Your MoonNexAI API key grants access to your account's quota and models. Use it only in a trusted server environment.

Usage recommendations

• Never place a key in frontend source, mobile packages, public repositories, screenshots or logs.
• Use <MOONNEXAI_API_KEY> in documentation examples.
• Use separate keys for local development, testing and production.
• Rotate a key in the MoonNexAI console if it appears in chats, screenshots, logs or public repositories.

Environment variables

Store API keys in server environment variables:

MOONNEXAI_API_KEY=<MOONNEXAI_API_KEY>

Node.js:

const apiKey = process.env.MOONNEXAI_API_KEY

Python:

import os

api_key = os.environ["MOONNEXAI_API_KEY"]

Request example

Authorization: Bearer <MOONNEXAI_API_KEY>

Do not place a key in a URL query string, as in this unsafe pattern:

https://moonnexai.com/v1/models?api_key=...

Frontend applications

Browser and mobile applications should call your own application server:

1. The frontend sends a request to your backend.
2. Your backend verifies the user's identity and permissions.
3. Your backend calls MoonNexAI with its API key.
4. Your backend returns the required result to the frontend.

This keeps the key out of browser developer tools, client network captures and distributed application packages.

Logging

• Log the request path, status code, task_id and your application's order ID.
• Do not log the Authorization header.
• Do not log sensitive user data from complete request bodies.
• For failures, record error.code and error.message.

Rotation

• Maintain separate keys for development, tests and production.
• Delete temporary test keys promptly after use.
• Rotate keys when a team member leaves, a repository becomes public, logs are shared or a key is copied into chat.
• Deploy the replacement key before revoking the old key to avoid interruption.