Security
API-key security
Store, scope, rotate, and revoke SkillRouter inference credentials safely.
Required handling
- Create separate keys for test, production, and independent workloads.
- Treat sr_test_* as real metered inference, not a provider mock or free tier. Every sr_live_* key uses production routing and commercial gates, independent of the server NODE_ENV.
- Store keys in a server secret manager and inject them only at runtime.
- Set the smallest practical key-level spend limit.
- Rotate a key after suspected exposure and update consumers immediately.
- Revoke unused keys and investigate their last-used timestamps.
SkillRouter stores a non-retrievable key hash and display prefix. Support staff cannot recover the complete plaintext key.
Do not expose upstream credentials
Provider keys such as OPENROUTER_API_KEY belong only in the API service secret store. They must never use a NEXT_PUBLIC_ prefix, enter dashboard payloads, or appear in customer errors and logs.