Security & privacy

Keep API keys on the server

Treat a Router API key as a secret. Store it in a server-side secret manager or environment variable. Never include it in browser JavaScript, mobile application bundles, public repositories, support messages, or screenshots.

Give each application its own named key. This makes usage easier to attribute and lets you revoke one integration without interrupting others.

Rotate an exposed key

1. Create a replacement in API keys.
2. Update the application secret and verify a request with the new key.
3. Revoke the exposed key.
4. Review Usage for unexpected requests.

Keys expire after 90 days, and an account can have at most 10 active keys. Revocation blocks new requests; an already-running request may finish.

Understand where prompts run

Router sends request content to a participating provider computer running the selected model. That computer can access the prompt and generated content while performing inference. Current participation is designed for trusted testers and non-sensitive prompts.

Minimize application data

Send only the conversation turns needed for the next answer. Remove internal metadata and secrets before building messages. Keep your own logs free of bearer tokens and full request content unless you have a deliberate retention and access policy.

Router usage records

API usage history stores operational metadata such as request ID, endpoint, timing, status, error code, and provider-reported token counts. It excludes prompts, answers, and key secrets.

Review authentication for the key lifecycle and message design for keeping prompts concise.