> For the complete documentation index, see [llms.txt](https://docs.apismart.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apismart.ai/api-tokens/secure-your-api-tokens.md).

# Secure Your API Tokens

ApiSmart uses **API Tokens** to authenticate API requests. Usage generated through these Tokens may be deducted from your wallet balance.

Anyone with access to a valid API Token may be able to make API requests and consume your wallet balance. Follow these practices to keep your Tokens secure.

***

### 🔐 Store API Tokens Securely

Store API Tokens in environment variables or another trusted server-side secret storage system.

#### macOS or Linux

```bash
export APISMART_API_KEY="YOUR_API_KEY"
```

#### Windows PowerShell

```powershell
$env:APISMART_API_KEY="YOUR_API_KEY"
```

Never commit production Tokens to source code or configuration files stored in Git.

***

### Never Expose API Tokens Publicly

Do not include API Tokens in:

* Public repositories
* Browser-side or client-side code
* Screenshots or screen recordings
* Shared documents or public support messages
* Application logs

When contacting support, provide only a masked Token or short prefix when needed.

***

### Use API Tokens on the Server Side

Do not call ApiSmart directly from a public browser application with your API Token.

Store the Token on your backend server and send API requests from there.

```
User Application
      ↓
Your Backend Server
      ↓
ApiSmart API Token
      ↓
ApiSmart API
```

Your backend should store the key securely and control which requests can be sent.

***

### Set Usage Limits

When creating an API Token, enable **Set Usage Limit** where appropriate.

A usage limit can help control the maximum amount a Token can consume if it is misconfigured or exposed.

> A usage limit reduces potential impact but does not replace proper Token protection.

***

### Use Separate API Tokens

Create separate Tokens for different environments or applications.

For example:

```
developmentproductionimage-generationvideo-generation
```

Separate Tokens make it easier to:

* Track usage
* Control spending
* Disable one application without affecting others
* Investigate unfamiliar requests

***

### Disable Unused API Tokens

Regularly review **Console → API Tokens** and disable Tokens that are no longer required.

Before deleting a Token, confirm that no active application or scheduled task still depends on it.

***

### 🔄Replace Exposed API Tokens

If a Token appears in public code, screenshots, frontend code, logs, or another untrusted location:

1. Disable the exposed Token immediately.
2. Create a replacement Token.
3. Update your application or environment variables.
4. Test the replacement Token.
5. Review **Usage Logs** for unfamiliar activity.

Delete the old Token when it is no longer required.

> Creating a replacement Token does not automatically disable the exposed one.

***

### Monitor Usage Regularly

Review **Usage Logs**, **Current Balance**, and **Total Consumption** for:

* Unexpected requests
* Unfamiliar models or Token activity
* Sudden increases in usage or cost

If you notice suspicious activity:

1. Disable the affected API Token.
2. Create a replacement if needed.
3. Review recent Usage Logs.
4. Save relevant Request IDs.
5. Contact support if necessary.

> ⚠️ Never send your full API Token, account password, or verification code to support.

***

### Next Steps

Continue with:

* [**Create and Manage API Tokens**](/api-tokens/create-and-manage-api-tokens.md)
* [**Usage Logs and Costs**](/api-usage/usage-logs-and-costs.md)
* [**View Your Balance and Transaction Records**](/account-and-wallet/view-your-balance-and-transaction-records.md)
* [**API Basics**](/api-guides/api-basics.md)