API key security
A key is a bearer credential: whoever holds it can spend your balance.
How Astrodyne stores keys
The full key is shown once, at creation. Only a hash and a short masked prefix are stored, so the plaintext cannot be recovered — not by you and not by us.
Handling rules
- Keep keys in environment variables or a secrets manager. Never in source control.
- Call the API from your server. A key in browser or mobile code is public.
- Use a separate key per environment and per workload, so one can be revoked without stopping everything.
- Set a monthly spending limit on keys used by unattended jobs.
- Set an expiry on keys issued for a short-lived purpose.
If a key is exposed
- Revoke it on API Keys. Revocation is immediate.
- Create a replacement and deploy it.
- Review Requests for calls you do not recognise.
Revoking is cheap
Revoking a key does not affect your balance, your other keys, or the history of
requests that key already made. If you are unsure whether a key leaked, revoke it.
The Playground
The Playground holds the key you paste in browser memory for that tab only. It is never stored and is sent only to the Astrodyne API.